The package @years18/n8n-nodes-utils-helper-b version 1.0.0 declares itself as a workflow-automation helper but includes a postinstall script that executes 'node callback.js'. This script downloads a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/mhddos.tgz over an HTTPS connection with disabled TLS verification, extracts it to /tmp/mhddos, installs Python dependencies, and runs 'python3 start.py'. Concurrently, it collects system identity information (id, hostname) and command outputs, encodes them in base64, and sends them as query parameters to https://jasabersama.id/portfolio-data.php, also without certificate validation. The behavior and file names indicate implant activity, with the Python payload being attacker-controlled code that runs automatically upon npm installation.

This malicious package can execute arbitrary attacker-controlled code on the host system during npm install. It collects sensitive host identity information and sends it to a remote server, potentially enabling further compromise or persistent implant activity. The lack of TLS verification increases the risk of man-in-the-middle attacks during payload retrieval.

No official patch or remediation is currently documented. Users should avoid installing version 1.0.0 of @years18/n8n-nodes-utils-helper-b. Verify package integrity and source before installation. Monitor for suspicious postinstall scripts in npm packages. Check vendor or repository advisories for updates or removal of the malicious package.