MAL-2026-13900 Malicious code in @years19/n8n-nodes-utils-helper-q (npm)

Package @years19/[email protected] ships two byte-identical top-level scripts (callback.js and index.js). package.json declares "main":"index.js" and "postinstall":"node callback.js", so the same payload fires both on npm install and on any require()/import of the package. On execution the scripts download multiple tarballs (mhddos, pyroxy, impacket, multidict) from jasabersama.id over HTTPS with certificate verification disabled (rejectUnauthorized:false), extract them under /tmp, and spawn python3 start.py in the background to launch UDP/TCP/GET flood traffic against 103.118.252.21 — turning the installer's machine into a DDoS attack node. Separately, the scripts run id and hostname, base64-encode the output, and send it via HTTPS GET to jasabersama.id/portfolio-data.php, exfiltrating installer host identity to a hardcoded attacker-controlled endpoint. Multiple auto-execution paths, TLS validation disabled, and an unrelated non-publisher host delivering opaque archives that are then executed match a canonical install-time RCE / dropper with concurrent host abuse and exfiltration.