The malicious package @years19/n8n-nodes-utils-helper-h (version 1.0.0) includes a post-install hook script (callback.js/index.js) that downloads four Python tarballs (mhddos, PyRoxy, impacket, and related payloads) from an external URL with TLS certificate validation disabled. These payloads are extracted into temporary and Python site-packages directories, and a Python script (start.py) is executed in the background. This script launches three concurrent 600-second DDoS floods (UDP, TCP, and HTTP GET) targeting IP 103.118.252.21 on ports 80 and 443. Additionally, the script collects host identity information, dependency-check output, process counts, and attack logs, encodes this data in base64, and sends it as query parameters to a remote server, again with TLS verification disabled. This behavior indicates the package is a malicious backdoor and DDoS bot.

The malicious package compromises the host system by executing unauthorized DDoS attacks, potentially implicating the user in attack traffic. It also exfiltrates system information and logs to an attacker-controlled server, risking data leakage and further compromise. The disabling of TLS verification increases the risk of man-in-the-middle attacks during payload download and data exfiltration.

Users should immediately uninstall the affected package version 1.0.0 of @years19/n8n-nodes-utils-helper-h. Avoid installing this package from untrusted sources. Since no official patch or remediation is provided, users must remove the package and any associated downloaded payloads manually. Monitor systems for signs of compromise and unauthorized network activity related to DDoS attacks. Verify the integrity of dependencies before installation.