The malicious npm package @years19/n8n-nodes-utils-helper-s version 1.0.0 includes a postinstall script that writes /tmp/attack.py, a Python UDP/TCP flooder targeting IP 103.118.252.21 on ports 80 and 443 for 600 seconds, and runs it in the background. The same malicious code is triggered when requiring the module via index.js, bypassing --ignore-scripts flags. The package also collects host identity data (user id, hostname, process list, load average), base64-encodes it, and sends it via HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled, exposing the host to reconnaissance and data exfiltration. The package falsely claims to be an n8n utility node but solely functions as malware for DDoS and data theft.

This malicious package compromises the host by executing a DDoS attack against a third-party IP, potentially implicating the host in attack traffic. It also performs host reconnaissance and exfiltrates sensitive system information to an attacker-controlled server, risking privacy and security of the affected system. The attack runs silently during installation and module import, increasing the risk of unnoticed compromise.

Avoid installing or using the @years19/n8n-nodes-utils-helper-s package version 1.0.0. Remove the package if already installed and investigate any suspicious network activity or system changes. Since no official patch or fix is available, rely on package removal and network defenses to mitigate impact. Monitor for any communications to jasabersama.id and block outbound traffic to this domain if possible. Verify package sources carefully before installation to prevent supply chain compromise.