The npm package @years18/n8n-nodes-utils-helper-w version 1.0.0 contains malicious code executed both in its postinstall hook and main entry point. The payload runs system commands to gather information (id, hostname), probes for Python packages, installs the 'impacket' Python module forcibly, and executes a staged MHDDoS attack script from /tmp. It exfiltrates collected data by encoding it in base64 and sending it as a URL parameter to a remote server with disabled TLS verification, facilitating data theft. The package's advertised functionality is a decoy to conceal this hostile behavior.

This malicious package compromises the system where it is installed by executing arbitrary commands, modifying the Python environment, and running a denial-of-service attack tool. It also exfiltrates sensitive system information to an attacker-controlled server, potentially enabling further compromise or reconnaissance. The integrity and security of the affected system are severely undermined by this package.

No official patch or remediation is available for this package. The best mitigation is to avoid installing @years18/n8n-nodes-utils-helper-w version 1.0.0. Remove any existing installations of this package immediately and investigate affected systems for signs of compromise. Use trusted sources and verify package authenticity before installation. Monitor for any unauthorized Python package installations or execution of scripts from /tmp.