The malicious npm package @years19/n8n-nodes-utils-helper-g (version 1.0.0) includes byte-identical dropper code in its postinstall script (callback.js) and main entrypoint (index.js). Upon npm install or require, it downloads several tarballs containing offensive network-attack software (mhddos, PyRoxy, impacket, multidict) from https://jasabersama.id with TLS verification disabled (rejectUnauthorized:false). These are extracted to /tmp/mhddos and the Python user-site directory, and a Python script (start.py) is executed. The code collects output from system commands (id, hostname) and execution results, base64-encodes this data, and sends it via HTTPS GET to a remote endpoint. This results in the host machine being compromised to run network-attack tools without user consent.

The malicious code leads to unauthorized execution of offensive network-attack tools on the affected host, potentially turning the system into a platform for launching attacks. It also leaks system information and execution results to a remote attacker-controlled server. This compromises the confidentiality, integrity, and availability of the host system and may facilitate further malicious activities.

No official patch or remediation is currently available. Users should avoid installing or using version 1.0.0 of @years19/n8n-nodes-utils-helper-g. Remove the package if already installed and scan affected systems for the presence of the downloaded tools and any unauthorized processes. Monitor for network connections to https://jasabersama.id and related domains. Check vendor advisories or trusted security sources for updates or fixes.