The @years19/n8n-nodes-utils-helper-i npm package (version 1.0.0) includes a postinstall script that executes callback.js, which downloads four malicious tarballs (mhddos, pyroxy-full, impacket, multidict) from a suspicious URL with TLS verification disabled. It then runs a Python script (start.py) that initiates UDP, TCP, and HTTP flood attacks targeting IP 103.118.252.21. Additionally, the script collects system identifiers (id, hostname), dependency-check output, process list, and attack logs, encodes this data in base64, and sends it via HTTPS GET requests to jasabersama.id as a beacon. The package's main entry point (index.js) contains the same malicious code, causing the download-and-execute chain to trigger upon requiring or importing the module.

This malicious package enables denial-of-service attacks by launching network floods against a specific IP address, potentially implicating users in attack traffic. It also compromises user system privacy by collecting and exfiltrating system and process information to a remote server. The disabled TLS verification increases the risk of man-in-the-middle tampering during payload download. Users installing or importing this package risk system compromise and involvement in malicious network activity.

No official patch or remediation is currently documented. Users should immediately remove and avoid using the @years19/n8n-nodes-utils-helper-i package version 1.0.0. Audit systems for presence of this package and any downloaded malicious payloads. Block network traffic to the indicated malicious domains and IP addresses. Monitor for unusual network flooding activity. Check vendor advisories or trusted security sources for updates or fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.