MAL-2026-13900

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (ec586045b554e26bad9faa1da63d8fe82c798ea3fe27d795908ab1c06882b25a) Package @years19/n8n-nodes-utils-helper-q@1.0.0 ships two byte-identical top-level scripts (callback.js and index.js). package.json declares "main":"index.js" and "postinstall":"node callback.js", so the same payload fires both on npm install and on any require()/import of the package. On execution the scripts download multiple tarballs (mhddos, pyroxy, impacket, multidict) from jasabersama.id over HTTPS with certificate verification disabled (rejectUnauthorized:false), extract them under /tmp, and spawn python3 start.py in the background to launch UDP/TCP/GET flood traffic against 103.118.252.21 — turning the installer's machine into a DDoS attack node. Separately, the scripts run `id` and `hostname`, base64-encode the output, and send it via HTTPS GET to jasabersama.id/portfolio-data.php, exfiltrating installer host identity to a hardcoded attacker-controlled endpoint. Multiple auto-execution paths, TLS validation disabled, and an unrelated non-publisher host delivering opaque archives that are then executed match a canonical install-time RCE / dropper with concurrent host abuse and exfiltration.