The npm package @years18/n8n-nodes-utils-helper-p version 1.0.0 includes a postinstall hook that runs 'node callback.js'. This script downloads two tarballs (mhddos.tgz and pyroxy.tgz) from jasabersama.id with TLS verification disabled, extracts them to temporary and Python user site-packages directories, installs Python network-attack dependencies using 'pip install --break-system-packages', and executes 'python3 start.py' from the extracted MHDDoS code. This effectively converts the host into a distributed denial-of-service (DDoS) attack node. The postinstall also captures system 'id' and 'hostname' outputs and installation progress, base64-encodes this information, and sends it as a query parameter to a remote URL (https://jasabersama.id/portfolio-data.php) without certificate verification. The presence of a node file named 'nodes/PwnNode.node.js' further indicates malicious intent, contradicting the package's advertised utility-node helper role.

Hosts installing this package version 1.0.0 are compromised to become part of a DDoS botnet, potentially participating in network attacks without user consent. The attacker gains system information and installation metadata, which is exfiltrated to a remote server. This compromises system integrity and privacy, and may lead to network abuse originating from the infected host.

No official patch or remediation is currently documented. Users should avoid installing or remove the @years18/n8n-nodes-utils-helper-p package version 1.0.0. Monitor for and block network connections to jasabersama.id and related domains. Conduct forensic analysis on affected hosts to detect and remove installed malicious Python packages and scripts. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.