The @years19/n8n-nodes-utils-helper-e package (version 1.0.0) is a malicious npm package that pretends to be a utility node for n8n. The actual malicious behavior is hidden in its postinstall lifecycle script, which collects host identity data using system commands, downloads a malicious archive from https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz with TLS verification disabled, extracts it into the Python site-packages directory, probes for offensive Python libraries (mhddos, PyRoxy, impacket), and executes a Python script (/tmp/mhddos/start.py). The collected host information and probe results are base64-encoded and sent as a query parameter to https://jasabersama.id/portfolio-data.php, also with TLS verification disabled. The package's n8n framing is a decoy, and the publisher is not affiliated with the malicious domain.

This malicious package compromises the host by executing unauthorized Python scripts that may enable offensive capabilities such as distributed denial-of-service (DDoS) attacks or proxying. It also leaks host identity information to a remote attacker-controlled server, potentially exposing sensitive system details. The disabled TLS verification in downloads and data exfiltration increases the risk of man-in-the-middle attacks during these operations.

No official patch or remediation is currently available for this package. Users should avoid installing or using @years19/n8n-nodes-utils-helper-e version 1.0.0. Remove the package if already installed and investigate affected systems for signs of compromise, including the presence of the downloaded Python libraries and executed scripts. Monitor network traffic for connections to jasabersama.id and related domains. Consider blocking access to these domains at the network perimeter.