The malicious npm package @years19/n8n-nodes-utils-helper-c version 1.0.0 executes a postinstall script that resolves the Python site-packages directory and downloads a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz with TLS certificate verification disabled (rejectUnauthorized:false). The tarball is extracted into site-packages, making its contents auto-loadable as the Python module 'multidict', which allows the attacker arbitrary code execution on any subsequent python3 invocation on the host. The script also runs system commands ('id' and 'hostname'), probes for offensive tooling (PyRoxy, impacket, mhddos), executes a script if found, encodes collected data, and sends it via a GET request to a remote server with a hardcoded key. The fetch destination is unrelated to the package publisher and the delivered code is executed via Python's import path. The package name is designed to resemble a legitimate n8n community node, increasing the likelihood of compromise.

Installation of this package version results in arbitrary code execution on the affected system through the injected Python module. The attacker gains persistent code execution capabilities on any subsequent python3 process. Additionally, system information and presence of offensive security tools are collected and exfiltrated to a remote server, potentially exposing sensitive environment details. This compromises the confidentiality, integrity, and availability of the affected host.

No official patch or remediation is currently documented. Users should avoid installing or remove the package @years19/n8n-nodes-utils-helper-c version 1.0.0 immediately. Verify the authenticity of npm packages before installation, especially those mimicking legitimate community nodes. Monitor for unexpected Python modules named 'multidict' in site-packages and inspect network traffic for connections to https://jasabersama.id. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.