The malicious npm package @years19/n8n-nodes-utils-helper-p (version 1.0.0) executes code both on postinstall and when required by n8n, bypassing typical script execution ignores. It fetches multiple tarballs from jasabersama.id over HTTPS with TLS verification disabled, extracts them to temporary and Python user directories, and launches three background Python3 processes running 'mhddos' attacks targeting IP 103.118.252.21 on UDP port 80, TCP port 443, and HTTP GET on port 80 for 600 seconds. The package collects system 'id' and 'hostname' outputs plus attack process status, base64-encodes this data, and sends it via HTTP GET to jasabersama.id with parameters that allow remote shell command execution, enabling a reporting and command channel for the attacker.

This malicious package enables an attacker to use the infected system to conduct distributed denial-of-service (DDoS) attacks against a hardcoded target, potentially implicating the victim in malicious activity. It also establishes a remote command and control channel allowing the attacker to execute arbitrary shell commands on the victim system, leading to potential full system compromise and data exfiltration.

No official patch or remediation is currently documented. Users should immediately uninstall version 1.0.0 of @years19/n8n-nodes-utils-helper-p and avoid using this package. Verify the integrity of dependencies before installation, and consider using package integrity verification tools or trusted package sources. Monitor for any unusual network activity or unexpected Python processes related to 'mhddos'. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.