The malicious npm package @years19/n8n-nodes-utils-helper-j (version 1.0.0) executes payload code both on npm install and when required. It fetches multiple malicious tarballs from https://jasabersama.id over TLS with certificate verification disabled, extracts them to /tmp and the user's site-packages, and spawns Python3 processes that flood a hardcoded target IP (103.118.252.21) with UDP, TCP, and HTTP traffic, performing a DDoS attack. Concurrently, it collects system identity data (output of 'id' and 'hostname'), dependency status, and attack logs, base64-encodes this data, and sends it as a query parameter to the attacker’s server. The disabling of TLS verification makes the transport resistant to certificate substitution attacks. This package effectively compromises the host by turning it into a DDoS bot and leaking sensitive host information.

Installing or importing this package results in the host machine being co-opted into a DDoS botnet, launching attacks against a specified target IP address. It also leaks sensitive host information such as user identity and hostname to the attacker. This compromises the confidentiality and availability of the affected system and potentially contributes to external denial-of-service attacks.

No official patch or remediation is currently documented. Users should immediately uninstall the package @years19/n8n-nodes-utils-helper-j version 1.0.0 if installed. Avoid installing or importing this package from untrusted sources. Monitor for any unauthorized network traffic to the IP 103.118.252.21 or connections to jasabersama.id. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.