MAL-2026-13901 Malicious code in @years19/n8n-nodes-utils-helper-r (npm)

The package declares postinstall: node callback.js and its main (index.js) is byte-identical to callback.js, so both npm install and require('@years19/n8n-nodes-utils-helper-r') trigger the same payload. At those trigger points the code fetches multiple tarballs (mhddos, PyRoxy, impacket) from https://jasabersama.id/assets/cache/.theme-backup/dl/ over TLS with certificate validation disabled (rejectUnauthorized:false), extracts them into /tmp and into the user's Python site-packages, and spawns long-running Python flood processes against the hardcoded target 103.118.252.21:80 via nohup python3 start.py UDP 103.118.252.21:80... &. In parallel, callback.js/index.js collect installer host identity (id, hostname, Python version, dependency presence, attack log tails), base64-encode the output, and send it in a query string to https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=<b64>. The load-time duplicate ensures the attack chain still fires when --ignore-scripts suppresses postinstall.