MAL-2026-13905 Malicious code in @years19/n8n-nodes-utils-helper-v (npm)

The package's postinstall hook runs node callback.js, and package.json declares main: index.js with byte-identical contents, so the payload fires on both npm install and require()/import. On execution the code writes a Python UDP/TCP flood script to /tmp/attack.py and launches it via nohup python3 /tmp/attack.py &, directing ~650 threads at 103.118.252.21 on ports 80/443 for 600 seconds. In parallel, the code runs id and hostname, collects process/loadavg indicators, base64-encodes the result, and sends it via https.get with rejectUnauthorized: false to https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=<encoded>. Installer hosts become participants in an outbound DDoS attack while also leaking host identity to a hardcoded endpoint.