The package @years18/n8n-nodes-utils-helper-v (version 1.0.0) contains malicious code hidden in its postinstall script. This script collects host identity data (such as user ID and hostname), encodes it in base64, and sends it to a hardcoded third-party endpoint (https://jasabersama.id/portfolio-data.php) with TLS verification disabled, increasing interception risk. Additionally, it installs the impacket network-attack library using pip with system package overrides and attempts to execute the MHDDoS tool from /tmp/mhddos/start.py. The package thus performs unauthorized reconnaissance, data exfiltration, and stages network attack tools on the victim's system during installation.

Installation of this package results in unauthorized collection and exfiltration of host identity information to a remote attacker-controlled server. It also leads to the installation and execution of offensive network attack tools on the host, potentially enabling the compromised system to participate in distributed denial-of-service (DDoS) attacks or other network-based attacks. This compromises the security and integrity of the installer's environment.

No official patch or remediation is available for this package. The best mitigation is to avoid installing the @years18/n8n-nodes-utils-helper-v package, especially version 1.0.0. Verify package authenticity before installation and use trusted sources. Remove the package and any installed components if already installed. Monitor for suspicious network activity related to the described exfiltration endpoint and installed tools.