MAL-2026-13898 Malicious code in @years19/n8n-nodes-utils-helper-o (npm)
Malicious package
Published
MAL-2026-13898 is a malicious package: @years19/n8n-nodes-utils-helper-o (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-13898/ (Markdown: https://insights.sbomify.com/MAL-2026-13898/index.md)
- Package
- @years19/n8n-nodes-utils-helper-o
- Registry
- npm
What is MAL-2026-13898?
MAL-2026-13898 is a malicious package in @years19/n8n-nodes-utils-helper-o, published on 12 Aug 2026.
Official description
On npm install (postinstall runs callback.js) and again on require of the package (identical payload in index.js as the declared main), the package downloads Python DDoS tooling (mhddos, PyRoxy, impacket, multidict tarballs) from https://jasabersama.id/assets/cache/.theme-backup/dl/ with TLS certificate validation disabled (rejectUnauthorized:false), extracts them under /tmp and the user site-packages, then spawns three detached python3 processes to flood 103.118.252.21 on UDP/80, TCP/443, and GET/80. The same script executes
id and hostname, base64-encodes the output along with attack process status, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php with a hardcoded key over the same TLS-verification-disabled channel. The package name mimics an n8n community node, so importing it inside an n8n instance re-triggers the payload via automatic node loading.What should I do about MAL-2026-13898?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.