The package @years18/n8n-nodes-utils-helper-g (version 1.0.0) includes a postinstall script (callback.js) and main entry point (index.js) that download a tarball and a Python installer from https://jasabersama.id over HTTPS with TLS verification disabled (rejectUnauthorized:false). It extracts these to /tmp/mhddos, installs Python pip forcibly, and executes a denial-of-service tool (MHDDoS/PyRoxy). Concurrently, it collects the host's unique ID, hostname, home directory, and environment classification (WSL/VM/container), base64-encodes this data, and sends it as a query parameter to the same remote server. The remote server uses a shell command to write the decoded data to a file on its side. This malicious activity is triggered both on npm install and when the package is imported or required.

This malicious package can lead to unauthorized execution of denial-of-service attack tools on the host system, potentially degrading system or network availability. It also exfiltrates sensitive environment and host information to a remote attacker-controlled server, leading to privacy and security risks. The disabled TLS verification increases the risk of man-in-the-middle attacks during payload retrieval.

No official patch or remediation is currently available. Users should immediately remove the package @years18/n8n-nodes-utils-helper-g version 1.0.0 from their environments and avoid installing or importing it. Verify dependencies to ensure this package is not included transitively. Monitor for any signs of compromise related to denial-of-service tools or unexpected network connections to jasabersama.id. Patch status is not yet confirmed — check the vendor or repository advisory for updates.