The package @years19/n8n-nodes-utils-helper-a (version 1.0.0) masquerades as an n8n utility helper but includes a postinstall lifecycle script that performs malicious actions. This script downloads a tarball from a remote URL with TLS verification disabled, extracts attack tooling (including PyRoxy, impacket, and mhddos scripts) into the Python site-packages directory, and executes them. It also runs system commands ('id' and 'hostname'), encodes their output along with results from the malicious payload, and exfiltrates this information via an HTTPS GET request to an attacker-controlled endpoint. The package effectively writes and runs attacker-controlled code on the installer's machine and leaks sensitive system information.

Installing this package leads to arbitrary code execution on the host system via the postinstall script. The attacker gains the ability to run attack tools on the victim's machine and exfiltrate system identity and execution data to a remote server. This compromises the confidentiality and integrity of the affected system and may facilitate further attacks.

No official patch or remediation is currently available for this malicious package. The best mitigation is to avoid installing @years19/n8n-nodes-utils-helper-a version 1.0.0 and remove it if already installed. Users should verify the authenticity of npm packages before installation and rely on trusted sources. Monitor for suspicious network activity related to the described endpoints and consider scanning for the presence of the dropped files and scripts.