MAL-2026-13908 Malicious code in @years19/n8n-nodes-utils-helper-y (npm)

The package advertises itself as an n8n community utility helper node (package.json declares n8n.nodes: ["nodes/PwnNode.node.js"] with description 'Utility helper nodes for workflow automation'), but its callback.js (invoked from the declared postinstall hook node callback.js) and its main entry index.js contain identical top-level code that: (1) writes a Python script to /tmp/attack2.py and launches it via nohup python3 /tmp/attack2.py... &, which floods 103.118.252.21 on ports 80/443 with UDP/TCP traffic using 2000 threads for 900 seconds; and (2) collects host identity (uid, hostname, process/load information), base64-encodes it, and sends it over HTTPS GET to jasabersama.id/portfolio-data.php with TLS certificate verification disabled (rejectUnauthorized:false). Because the dropper is both in the postinstall script and at the top level of the main module, it executes on npm install and again every time a consumer requires the package or n8n loads the node.