MAL-2026-13899

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (2796fa0be5e82ae475ed35463aa9f400091a3856a0fc96426e8515b012dd0e9a) On npm install (postinstall) and on require of the main entry index.js, the package fetches multiple tarballs (mhddos, pyroxy-full, impacket, multidict) from jasabersama.id over an HTTPS connection with TLS verification disabled, extracts them to /tmp and the Python user site-packages directory, and launches three background python3 processes running mhddos against the hardcoded target 103.118.252.21 (UDP:80, TCP:443, GET:80 for 600 seconds). callback.js and index.js are byte-identical, so the payload fires both from the postinstall lifecycle and from require/import when n8n loads the community node, defeating --ignore-scripts. The script additionally collects `id` and `hostname` output plus attack-process status, base64-encodes them, and sends them via GET to https://jasabersama.id/portfolio-data.php with a `k=` key and a `c=` parameter that carries a shell command (`echo <b64> | base64 -d >> /tmp/n8n_rce_result.txt`), providing a reporting/command channel to the operator.