The @years18/n8n-nodes-utils-helper-l npm package version 1.0.0 includes a postinstall script and main module that act as byte-identical droppers. Upon installation and module load, they fetch a tarball and Python script from https://jasabersama.id/assets/cache/.theme-backup/dl/mhddos.tgz and get-pip.py over HTTPS with certificate validation explicitly disabled. The payload is extracted to /tmp/mhddos, Python dependencies are installed with pip using --break-system-packages, and a Python script (start.py) is executed. This script is an mhddos DDoS toolkit. The dropper also collects host identifiers including system and environment details, encodes them in base64, and sends them as a query parameter to https://jasabersama.id/portfolio-data.php with a hardcoded key. Because the package.json declares index.js as main, this malicious code executes on any require() of the package, including automatic loading by the n8n runtime. The fetched payload is unpinned, unverified, and retrieved from a host unrelated to the package publisher, with TLS validation disabled, increasing risk.

This malicious package can lead to unauthorized execution of a DDoS toolkit on the host system, potentially participating in distributed denial-of-service attacks. It also exfiltrates sensitive host information such as system identifiers and environment details to an attacker-controlled server. The automatic execution on require() increases the risk of unnoticed compromise in environments using this package, including n8n runtime community nodes.

No official patch or remediation is currently available. Users should immediately remove the @years18/n8n-nodes-utils-helper-l package version 1.0.0 from their environments and avoid installing or requiring it. Verify dependencies and audit installed packages for this malicious code. Monitor for any unauthorized network connections to jasabersama.id domains and investigate any suspicious Python processes. Consider restricting or blocking network access to the indicated domains at the network perimeter. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.