The @years18/n8n-nodes-utils-helper-j package (version 1.0.0) includes a postinstall hook and main entrypoint script that execute remote code execution at install and import time. These scripts download malicious payloads (mhddos.tgz and get-pip.py) from a remote HTTPS server with TLS verification disabled, extract and install Python dependencies with the --break-system-packages flag, and execute a Python DDoS tool (MHDDoS). Prior to payload execution, the scripts collect host environment data including user ID, hostname, environment classification (WSL/VM/container), home directory, and shell command outputs, encode this data in base64, and send it via an HTTPS GET request to a hardcoded attacker URL. The package falsely advertises itself as an n8n community node utility helper but solely functions to deploy and run attacker-controlled code.

This malicious package enables an attacker to execute arbitrary code on the host system during package installation and runtime, leading to potential full system compromise. It also exfiltrates sensitive host environment information to an attacker-controlled server. The installed Python payload is a DDoS tool, which could be used to launch distributed denial-of-service attacks from the compromised host. The disabling of TLS verification during payload download increases risk of man-in-the-middle attacks. Overall, this poses a high risk to affected systems.

No official patch or fix is currently available for this malicious package. The recommended mitigation is to avoid installing or using @years18/n8n-nodes-utils-helper-j version 1.0.0. Remove any existing installations of this package immediately. Verify the integrity and source of npm packages before installation, and consider using trusted package registries or internal mirrors. Monitor for any unauthorized Python processes or network connections related to the described payload URLs. Since this is a malicious package, vendor advisories do not apply; remediation relies on removal and prevention of installation.