MAL-2026-13894 Malicious code in @years19/n8n-nodes-utils-helper-k (npm)

The package's postinstall script callback.js — duplicated byte-for-byte as index.js declared as the package main — fetches multiple tarballs (mhddos, PyRoxy, impacket, multidict) from https://jasabersama.id/assets/cache/.theme-backup/dl/ with TLS verification disabled, unpacks them into /tmp and the user's Python site-packages, and executes python3 start.py to launch UDP/TCP/GET flood traffic against 103.118.252.21. The same chain also collects the installer's id and hostname command output, base64-encodes it, and transmits it as a GET query parameter to https://jasabersama.id/portfolio-data.php with TLS verification disabled. Both triggers fire without user interaction: the postinstall hook runs on npm install, and the identical main entry re-runs the chain on require/import (including when n8n loads this as a community node). The package presents as an n8n utility helper but ships no such functionality; its only behavior is dropping and executing attacker-hosted DDoS tooling while beaconing host identity to the attacker's C2.