The @years18/n8n-nodes-utils-helper-r npm package version 1.0.0 includes a postinstall script that downloads a tarball from an untrusted source with TLS certificate verification disabled. This tarball contains the PyRoxy / MHDDOS DDoS attack framework, which is extracted into the Python site-packages directory and executed. The script also collects system information (output of 'id' and 'hostname'), encodes it, and sends it via HTTPS GET to a remote server with certificate verification disabled. The package falsely presents itself as an n8n community utility node but actually delivers malicious offensive tooling.

Installation of this package results in the deployment and execution of a DDoS attack framework on the affected system, potentially enabling the system to participate in distributed denial-of-service attacks. It also leaks system identity information to a remote attacker-controlled server, compromising confidentiality and potentially aiding further attacks.

No official patch or remediation is currently documented. Users should avoid installing version 1.0.0 of @years18/n8n-nodes-utils-helper-r. Remove the package if already installed and investigate systems for the presence of the PyRoxy / MHDDOS framework and related artifacts. Monitor for suspicious network activity related to the remote server jasabersama.id. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.