MAL-2026-13899 Malicious code in @years19/n8n-nodes-utils-helper-p (npm)

On npm install (postinstall) and on require of the main entry index.js, the package fetches multiple tarballs (mhddos, pyroxy-full, impacket, multidict) from jasabersama.id over an HTTPS connection with TLS verification disabled, extracts them to /tmp and the Python user site-packages directory, and launches three background python3 processes running mhddos against the hardcoded target 103.118.252.21 (UDP:80, TCP:443, GET:80 for 600 seconds). callback.js and index.js are byte-identical, so the payload fires both from the postinstall lifecycle and from require/import when n8n loads the community node, defeating –ignore-scripts. The script additionally collects id and hostname output plus attack-process status, base64-encodes them, and sends them via GET to https://jasabersama.id/portfolio-data.php with a k= key and a c= parameter that carries a shell command (echo <b64> | base64 -d >> /tmp/n8n_rce_result.txt), providing a reporting/command channel to the operator.