The malicious npm package @years18/n8n-nodes-utils-helper-t (version 1.0.0) executes a payload both on npm install and when required. This payload runs system commands ('id' and 'hostname'), base64-encodes their output, and sends it to a remote server via an unverified TLS connection. It also receives and executes shell commands from the server, writing results to a temporary file, effectively creating a remote command execution channel. Furthermore, it installs the 'impacket' Python package with a flag to break system package protections, probes for 'PyRoxy', and runs a Python script to stage and launch an mhddos DDoS toolkit on the compromised host. The package name is crafted to resemble a legitimate n8n community node to deceive users.

This malicious package compromises the host system by exfiltrating system information, disabling TLS verification to evade detection, enabling remote command execution, and deploying a DDoS toolkit that can be used to launch attacks from the infected system. This can lead to unauthorized control, data leakage, and participation in distributed denial-of-service attacks.

No official patch or remediation is available for this malicious package. Users should avoid installing @years18/n8n-nodes-utils-helper-t version 1.0.0. Remove the package immediately if installed and perform a thorough investigation of the affected system for signs of compromise, including the presence of the mhddos toolkit and any unauthorized Python packages. Use trusted sources and verify package authenticity before installation.