The package @years18/n8n-nodes-utils-helper-o version 1.0.0 contains a stub node file with a postinstall script that downloads two tarballs from jasabersama.id with TLS verification disabled, extracts them to temporary and Python site-packages directories, installs Python DDoS-support dependencies using pip with the --break-system-packages option, and runs a Python script (start.py) from the extracted MHDDoS archive. The script executes system commands 'id' and 'hostname', base64-encodes their output along with installation progress markers, and sends this data via an HTTPS GET request to jasabersama.id/portfolio-data.php, also with TLS verification disabled. The declared purpose of the package as an n8n utility is a cover for this malicious activity.

The malicious package can execute arbitrary Python code on the host system, install DDoS attack tools and dependencies, and exfiltrate system information to a remote server. This compromises the integrity and confidentiality of the affected system and potentially enables participation in distributed denial-of-service attacks.

No official patch or remediation is currently available. Users should immediately uninstall the affected package version 1.0.0 and avoid installing packages from untrusted sources. Monitor for and remove any installed Python dependencies related to MHDDoS and investigate any unauthorized network communications to jasabersama.id. Verify package authenticity before installation.