The malicious npm package @years18/n8n-nodes-utils-helper-k (version 1.0.0) includes a postinstall script and main module that download a tarball and a Python script from a remote server with disabled TLS verification. The downloaded payload is the MHDDoS DDoS toolkit, which is extracted and installed with pip using the --break-system-packages flag, then executed. Additionally, the package collects system identity data such as user ID, hostname, and environment indicators, encodes this data in base64, and sends it via an HTTPS GET request to a remote exfiltration endpoint. The malicious code triggers both at npm install and at module import, compromising hosts regardless of lifecycle script settings. Payload paths and exfiltration URLs are disguised to evade detection.

Hosts that install or import this package are compromised by execution of a DDoS toolkit, potentially enabling participation in distributed denial-of-service attacks. Sensitive system information is exfiltrated to an attacker-controlled server, risking privacy and operational security. The use of disabled certificate verification increases the risk of man-in-the-middle attacks during payload download. The compromise occurs silently during normal package usage, increasing the likelihood of unnoticed infection.

No official patch or remediation is currently available for this malicious package. Users should immediately remove @years18/n8n-nodes-utils-helper-k version 1.0.0 from their environments and avoid installing or importing this package. Audit systems for signs of the MHDDoS toolkit or unusual network traffic to jasabersama.id domains. Consider blocking network access to the indicated URLs and paths at the firewall level. Monitor for any unauthorized Python processes or pip installations. Check vendor advisories or npm security advisories for updates or removal notices.