The malicious npm package @years19/n8n-nodes-utils-helper-o (version 1.0.0) executes a post-install and runtime payload that downloads several Python DDoS tools (mhddos, PyRoxy, impacket, multidict) from a remote server with disabled TLS certificate validation. It extracts these tools under /tmp and user site-packages, then spawns three detached Python3 processes to conduct DDoS attacks targeting IP 103.118.252.21 on UDP/80, TCP/443, and HTTP GET/80. Additionally, it collects system information via 'id' and 'hostname' commands, base64-encodes the output along with attack status, and exfiltrates this data to a remote URL using the same insecure TLS channel. The package name is crafted to resemble an n8n community node, causing automatic payload execution when imported in n8n workflows.

This malicious package enables unauthorized DDoS attacks from infected systems, potentially implicating users in attack traffic. It also leaks system information to an attacker-controlled server, compromising confidentiality. The disabled TLS verification increases risk of man-in-the-middle interception during payload download and data exfiltration. Systems running this package version may be used as part of a botnet or for further malicious activities.

No official patch or remediation is currently documented. Users should immediately uninstall the @years19/n8n-nodes-utils-helper-o package version 1.0.0 and avoid installing or importing it. Verify the integrity and source of npm packages before use, especially those mimicking community nodes. Monitor for unexpected Python processes and network traffic to the indicated IP address. Check for updates or advisories from npm or the package maintainer for remediation guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.