The npm package @years18/n8n-nodes-utils-helper-x version 1.0.0 contains malicious code executed during the npm install process via a postinstall script (callback.js). This script downloads two tarballs (impacket.tgz and pyroxy.tgz) over HTTPS with TLS verification disabled from a suspicious domain, extracting them into the Python user site-packages directory. This enables attacker-controlled Python code execution on the host. Additionally, the script probes for the presence of MHDDoS DDoS tooling and collects system identifiers (output of 'id' and 'hostname'), encoding and exfiltrating this data via an HTTPS GET request to a remote server. The package's declared purpose as an n8n utility helper is a facade for this malicious activity.

Successful installation of this package leads to arbitrary code execution on the victim's system through the installation of attacker-controlled Python modules. It also results in information disclosure by sending system identifiers and installation status to an external server. The presence of probing for DDoS tooling suggests potential reconnaissance or further malicious activity. This compromises the integrity and confidentiality of the affected system.

No official patch or remediation is currently documented. Users should immediately uninstall and avoid using the @years18/n8n-nodes-utils-helper-x package version 1.0.0. Verify dependencies and sources before installation, and consider scanning existing environments for the presence of this package and the downloaded Python modules. Monitor network traffic for connections to jasabersama.id and investigate any suspicious activity. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.