The @years19/n8n-nodes-utils-helper-b npm package (version 1.0.0) is a malicious dropper disguised as a utility helper for n8n automation. Its main node is a non-functional stub, while the postinstall script executes commands to gather system information and downloads a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz without proper TLS verification. This tarball is extracted into the Python site-packages directory, enabling arbitrary code execution on future Python imports. Additionally, the package scans for offensive security tools such as PyRoxy, impacket, and MHDDoS start.py, then encodes and exfiltrates this reconnaissance data along with system identifiers to https://jasabersama.id/portfolio-data.php. The declared utility purpose is a cover for this malicious activity.

This package enables remote attackers controlling the tarball URL to execute arbitrary code on the victim's system with the privileges of the user installing the package. The malicious postinstall script also performs reconnaissance by detecting offensive security tools on the host and exfiltrates sensitive system information. This can lead to persistent compromise, data leakage, and further exploitation of the affected environment.

No official patch or remediation is currently documented for this package. Users should avoid installing @years19/n8n-nodes-utils-helper-b version 1.0.0. Remove any installations of this package and investigate systems for signs of compromise, especially presence of the downloaded tarball in Python site-packages and network connections to jasabersama.id. Use trusted sources and verify package integrity before installation. Monitor for suspicious postinstall scripts in npm packages.