The malicious npm package @years18/n8n-nodes-utils-helper-c version 1.0.0 executes a postinstall script that performs two hostile actions: it downloads a tarball containing the MHDDoS attack tool from an untrusted source with TLS verification disabled, installs its Python dependencies with a flag that breaks system package integrity, and runs the attack tool. Additionally, it collects system information (user ID, hostname, and process list filtered for 'implant'), base64-encodes this data, and sends it via an unverified TLS GET request to a remote server. These behaviors constitute malicious code execution and data exfiltration unrelated to the package's stated purpose.

Installation of this package leads to execution of a denial-of-service attack tool (MHDDoS) on the host system and exfiltration of sensitive system reconnaissance data to an attacker-controlled server. This compromises system integrity and confidentiality, potentially enabling further attacks or misuse of the infected system.

No official patch or remediation is currently available for this package. Users should avoid installing version 1.0.0 of @years18/n8n-nodes-utils-helper-c. If already installed, remove the package and investigate the system for any signs of compromise or unauthorized activity related to MHDDoS or data exfiltration. Monitor for updates from the package maintainer or npm registry regarding remediation.