The malicious npm package @years18/n8n-nodes-utils-helper-u version 1.0.0 includes a postinstall script that executes unconditionally on npm install. This script runs system commands `id` and `hostname`, base64-encodes their output, and transmits it as a query parameter to a hardcoded HTTPS URL with TLS certificate validation disabled (rejectUnauthorized: false). The script installs the Python 'impacket' package system-wide using pip with the --break-system-packages flag and executes a Python script (/tmp/mhddos/start.py) that launches an MHDDoS attack, weaponizing the compromised host for outbound denial-of-service attacks. The remote URL also accepts a 'c=' parameter that decodes attacker-supplied bytes into a file on the host, enabling a command-staging channel for remote code execution.

This malicious package compromises the host system by exfiltrating system information, disabling secure TLS validation, installing additional attack tools, and launching denial-of-service attacks against external targets. It also enables remote command execution on the infected system, potentially allowing attackers to control or further compromise the host.

No official patch or remediation is currently available. Users should immediately uninstall the affected package version (=1.0.0) and avoid using this package. Review systems for signs of compromise, including unexpected Python packages and running MHDDoS attack scripts. Consider blocking network traffic to the malicious domain jasabersama.id. Monitor for unauthorized processes and remove any malicious artifacts. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.