@years18/n8n-nodes-utils-helper-q version 1.0.0 is a malicious npm package that executes a hostile postinstall lifecycle script. This script downloads two tarballs (mhddos.tgz and pyroxy.tgz) from a remote server with TLS verification disabled, unpacks them into temporary and Python site-packages directories, installs required Python packages forcibly overriding system protections, and runs a Python-based DDoS attack tool (MHDDoS). Additionally, it collects system information (user id and hostname), encodes it in base64, and sends it via an unverified TLS GET request to a remote endpoint. The package's apparent purpose as a trivial 'Helper Utils' node is a cover for this attack chain.

Installing this package results in the host machine being enrolled as a node in a distributed denial-of-service (DDoS) attack network without user consent. It compromises system integrity by forcibly installing Python packages and running unauthorized code. It also leaks system identification data to an attacker-controlled server, potentially aiding further targeted attacks or reconnaissance.

No official patch or remediation is currently documented for this package. Users should avoid installing @years18/n8n-nodes-utils-helper-q version 1.0.0. Remove any installations of this package immediately and scan affected systems for the presence of the MHDDoS tool and related Python dependencies. Monitor for unusual network activity indicative of DDoS participation. Since this is a malicious package, rely on trusted sources and verify package integrity before installation.