The package @years18/n8n-nodes-utils-helper-y version 1.0.0 includes a postinstall hook that executes 'node callback.js'. This script downloads three tarballs (mhddos, pyroxy-full, impacket) from a remote server over HTTPS but with TLS verification disabled (rejectUnauthorized:false). It extracts pyroxy-full and impacket into the user's Python site-packages directory, making them importable by future Python processes, and stages mhddos under /tmp. It then runs 'python3 start.py' from the mhddos toolkit. Additionally, it collects system identifiers (output of 'id' and 'hostname') and toolkit verification results, encodes this data in base64, and sends it via an HTTPS GET request to an attacker-controlled endpoint, also with TLS verification disabled. This behavior causes automatic execution of attacker-controlled code during npm install, persistent implantation of offensive Python toolkits, and exfiltration of host information.

The malicious postinstall script leads to automatic execution of attacker-controlled code on the host during package installation. It implants offensive Python toolkits (impacket, PyRoxy, mhddos) into the user's environment, which can be used for further malicious activities. The package also exfiltrates system information to an attacker-controlled server, potentially enabling targeted follow-up attacks or reconnaissance. This compromises the confidentiality, integrity, and availability of the affected system.

No official patch or remediation is currently available for this package version. Users should avoid installing @years18/n8n-nodes-utils-helper-y version 1.0.0. Remove any installations of this package and the implanted Python toolkits from the system. Monitor for any suspicious Python modules in site-packages and unexpected processes related to mhddos or PyRoxy. Check vendor advisories or trusted security sources for updates or fixes before considering reinstallation.