The '@years19/n8n-nodes-utils-helper-r' npm package version 1.0.0 includes a malicious postinstall script and main module (callback.js/index.js) that trigger the same payload. This payload downloads attack tool tarballs from a remote server with disabled TLS certificate verification, extracts them into system directories, and initiates persistent Python-based flood attacks against the IP 103.118.252.21 on port 80. Concurrently, it collects system and environment data, encodes it in base64, and sends it via HTTP query to a remote endpoint. The duplicate payload execution ensures the attack activates even if npm install scripts are ignored.

The malicious package enables remote attackers to execute denial-of-service flood attacks from the compromised host against a hardcoded target IP. It also compromises host confidentiality by exfiltrating system identity and environment information to an attacker-controlled server. The attack runs persistently and can degrade system performance or network availability. This compromises the integrity and availability of the affected system and potentially other network resources.

No official patch or remediation is currently documented for this package version. Users should avoid installing or using '@years19/n8n-nodes-utils-helper-r' version 1.0.0. Remove any installations of this package immediately. Monitor for and terminate any unauthorized Python flood processes. Validate all dependencies before use and prefer trusted sources. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.