The malicious npm package @years19/n8n-nodes-utils-helper-m (version 1.0.0) includes a postinstall script that fetches several Python packages (mhddos, PyRoxy, impacket, multidict) from a remote server over HTTPS with TLS verification disabled (rejectUnauthorized:false). These packages are extracted into temporary directories and the user's Python site-packages. The script then launches three persistent Python3 processes that direct traffic at a hardcoded IP address, effectively turning the host into a DDoS bot. Additionally, the script executes system commands ('id' and 'hostname'), base64-encodes their output, and sends it as a query parameter to an attacker-controlled URL. The attacker can also write arbitrary base64-decoded data to a file on the victim's system via a crafted URL parameter. Despite the package's name implying it is an n8n-nodes utility, it contains no legitimate functionality and is purely malicious.

Hosts that install this package are compromised by running unauthorized Python processes that participate in DDoS attacks against a fixed target, potentially implicating the victim in malicious network activity. The attacker gains system information and can write arbitrary files to the victim's filesystem, which may facilitate further compromise or persistence. This undermines system integrity and confidentiality.

No official patch or remediation is currently documented for this package. Users should avoid installing @years19/n8n-nodes-utils-helper-m version 1.0.0. Remove the package and any related Python processes if already installed. Monitor systems for unexpected Python processes and network traffic to the specified attacker domains or IP addresses. Verify package authenticity before installation and prefer trusted sources. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.