The npm package @years19/n8n-nodes-utils-helper-n (version 1.0.0) includes a postinstall script that executes node callback.js, which is identical to the main module. This script downloads four tarballs (mhddos, pyroxy-full, impacket, multidict) from a remote server with TLS verification disabled, extracts them into temporary and site-package directories, and launches three background Python3 processes running mhddos start.py in various attack modes against a specified IP address. Additionally, it collects the output of 'id' and 'hostname' commands, base64-encodes this data, and sends it as a query parameter to a remote URL with TLS verification disabled. This behavior effectively turns the host into a participant in a distributed denial-of-service (DDoS) attack and leaks system information to an attacker-controlled server.

Hosts that install or require this package version are compromised by running malicious code that weaponizes the system for DDoS attacks against a targeted IP address. The package also exfiltrates system identification data to an attacker-controlled server. This can lead to resource exhaustion, network disruption, and privacy breaches on affected systems.

No official patch or remediation is currently documented. Users should immediately avoid installing or using version 1.0.0 of @years19/n8n-nodes-utils-helper-n. Remove the package from any affected systems and investigate for signs of compromise, including running background Python processes and unexpected network traffic. Monitor and block communications to the indicated malicious domains. Check the vendor or npm advisories for updates on remediation or package removal.