The malicious npm package @years19/n8n-nodes-utils-helper-k version 1.0.0 includes a postinstall script and a main entry point that both trigger the same malicious behavior. This behavior involves fetching multiple tarballs from an attacker-controlled domain with TLS verification disabled, unpacking them into temporary and Python site-package directories, and executing a Python script that performs network flood attacks against IP 103.118.252.21. The package also collects the installer's system ID and hostname, encodes this information in base64, and sends it via an unverified TLS GET request to the attacker's server. These actions occur automatically on npm install and when the package is imported or required, including when loaded as an n8n community node. The package does not provide any legitimate utility functions and solely serves as a delivery mechanism for DDoS tools and host reconnaissance.

This package enables attackers to conduct distributed denial-of-service (DDoS) attacks by using compromised hosts to flood a target IP with UDP, TCP, and GET requests. It also compromises host confidentiality by exfiltrating system identifiers to an attacker-controlled server. The automatic execution on installation and import increases the risk of widespread compromise in environments using this package.

No official patch or remediation is currently documented. Users should immediately remove and avoid installing or importing the @years19/n8n-nodes-utils-helper-k package version 1.0.0. Verify all dependencies for authenticity and consider scanning for indicators of compromise related to this package. Monitor network traffic for unusual outbound connections to jasabersama.id and the targeted IP 103.118.252.21. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.