The package @years19/[email protected] includes two identical scripts (callback.js and index.js) that execute on npm install and on require/import. These scripts download several tarballs (mhddos, pyroxy, impacket, multidict) from jasabersama.id over HTTPS with certificate verification disabled (rejectUnauthorized:false). The tarballs are extracted to /tmp, and a Python script (start.py) is launched in the background to perform UDP, TCP, and HTTP GET flood attacks targeting IP 103.118.252.21. Concurrently, the scripts run 'id' and 'hostname' commands, base64-encode their output, and send it via HTTPS GET to jasabersama.id/portfolio-data.php, exfiltrating host identity data. This constitutes an install-time remote code execution and dropper mechanism that abuses the host for DDoS attacks and leaks sensitive information.

Installation or import of this package results in the compromised host being used as a node in a distributed denial-of-service (DDoS) attack against a hardcoded IP address. Additionally, sensitive system information (user and hostname) is exfiltrated to an attacker-controlled server. This compromises the confidentiality and availability of the affected system and potentially other network targets.

No official fix or patch is currently available for this malicious package version. Users should avoid installing or importing @years19/[email protected]. Remove any existing installations of this package immediately. Monitor for any unauthorized network traffic indicative of DDoS activity or data exfiltration. Consider using trusted package sources and verifying package integrity before installation.