MAL-2026-13893 Malicious code in @years19/n8n-nodes-utils-helper-j (npm)

package.json postinstall runs callback.js, and index.js (declared main) is byte-identical, so both npm install and any require() of the package trigger the same payload. The code fetches multiple tarballs (mhddos, PyRoxy, impacket, multidict) from https://jasabersama.id over TLS with certificate verification disabled (rejectUnauthorized:false), extracts them into /tmp and the user's site-packages, and spawns python3 processes that flood a hardcoded target at 103.118.252.21 with UDP/TCP/HTTP traffic. In parallel, callback.js collects the output of id and hostname, dependency status, and attack log tails, base64-encodes them, and sends them as a query parameter to https://jasabersama.id/portfolio-data.php; the c parameter is also shaped as a shell command for the receiving endpoint. Disabling TLS verification and pinning nothing makes the transport resilient to substitution of the attacker host's certificate. Installing or importing this package turns the host into a DDoS bot under the installer's user account and leaks host identity to the attacker endpoint.