This threat involves the npm package @years18/n8n-nodes-utils-helper-e version 1.0.0, which contains embedded malicious behavior. Upon installation, a postinstall hook executes callback.js, which downloads a Python pip installer to /tmp, installs dependencies, and launches a Python DDoS toolkit (mhddos) from /tmp/mhddos. The package probes an internal network IP (10.131.106.93:8888) and collects system identity information (via 'id' and 'hostname' commands). This data is base64-encoded and sent as a query parameter to https://jasabersama.id/portfolio-data.php with TLS verification disabled. The remote server responds with shell commands that are saved and executed locally, establishing a staged remote code execution channel. The package name suggests a utility for n8n but is in fact a malicious dropper and command relay.

The malicious package enables attackers to execute arbitrary commands on affected systems via a staged remote code execution channel. It also installs and launches a DDoS toolkit, potentially implicating infected hosts in distributed denial-of-service attacks. Additionally, it probes internal network addresses, which could facilitate lateral movement or reconnaissance. System identity and command output are exfiltrated to an attacker-controlled server, compromising confidentiality and system integrity.

No official patch or remediation is currently available. Users should immediately uninstall the @years18/n8n-nodes-utils-helper-e package version 1.0.0 if present. Avoid installing packages from untrusted or unknown sources. Monitor for any signs of the described malicious activity, such as unexpected Python processes, network connections to jasabersama.id, or files in /tmp related to mhddos or n8n_rce_result.txt. Consider scanning systems for this package and related artifacts and removing them. Check vendor advisories or trusted security sources for updates or official guidance.