The package @years18/n8n-nodes-utils-helper-m version 1.0.0 includes a postinstall script and main entrypoint that execute identical malicious payloads. These payloads download a tarball from a remote URL with TLS verification disabled, extract it into the Python site-packages directory using the --break-system-packages flag, and run a Python script (start.py) associated with the mhddos / PyRoxy DDoS tool. Additionally, the code collects the installer's user ID, hostname, and command execution output, base64-encodes this information, and sends it as a query parameter to a remote server, again bypassing TLS verification. The package falsely claims to be an n8n community-nodes helper but contains no legitimate helper functionality.

This malicious package can execute arbitrary code on the host system during installation and runtime, potentially enabling distributed denial-of-service (DDoS) attacks via the mhddos / PyRoxy tool. It also exfiltrates sensitive system information and command output to an attacker-controlled server. The disabled TLS verification increases the risk of man-in-the-middle attacks during payload download and data exfiltration.

No official patch or remediation is currently available. Users should immediately uninstall and avoid using version 1.0.0 of @years18/n8n-nodes-utils-helper-m. Verify package authenticity before installation and prefer official or well-maintained packages. Monitor for suspicious network activity related to the described URLs and consider network-level blocking of the domains involved. Check vendor advisories or trusted security sources for updates or fixes.