The malicious npm package @years18/n8n-nodes-utils-helper-f version 1.0.0 executes a postinstall hook that runs shell commands such as 'id' and 'hostname' to collect host data. It probes an internal RFC1918 IP address (10.131.106.93:8888) via a TCP connection and base64-encodes the output, sending it via an HTTPS GET request to jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized: false). The remote server decodes this data into a temporary file. Subsequently, the script downloads and runs a Python script to install pip with the '--break-system-packages' option, installs dependencies from a requirements file, and launches a Python-based DDoS tool (mhddos) from /tmp/mhddos. This sequence results in host reconnaissance, internal network probing, data exfiltration, and remote code execution that converts the installer machine into a DDoS attack node.

This malicious package compromises the security of any system on which it is installed by executing arbitrary code during installation. It performs host reconnaissance and internal network scanning, exfiltrates sensitive information to an attacker-controlled server, and installs and runs a DDoS framework that can be used to launch attacks from the compromised host. This can lead to unauthorized data disclosure, network reconnaissance by attackers, and the victim machine being co-opted into a botnet for DDoS attacks.

No official patch or remediation is currently documented. Users should avoid installing version 1.0.0 of the @years18/n8n-nodes-utils-helper-f package. Verify package authenticity before installation and prefer packages from trusted sources. Monitor for suspicious postinstall scripts in npm packages. Since this is a malicious package, removal of the package and thorough system inspection and cleanup are recommended if installed.