The package @years19/n8n-nodes-utils-helper-t (version 1.0.0) includes a postinstall script and main entry point that execute automatically on npm install and require/import. These scripts write a Python script (/tmp/attack.py) that performs UDP/TCP flooding against the IP 103.118.252.21 for 600 seconds, launching it in the background. Simultaneously, the package collects the output of system commands (id, hostname) and system metrics (process and load average), base64-encodes this information, and sends it via HTTPS to https://jasabersama.id/portfolio-data.php with TLS certificate verification disabled (rejectUnauthorized: false). This behavior constitutes remote code execution on the installer host, unauthorized participation in a DDoS attack, and exfiltration of host identity data.

Hosts that install or import this package are coerced into launching a DDoS attack against a third-party IP address, potentially implicating the host owner in malicious activity. Additionally, sensitive system identity and load information is exfiltrated to an attacker-controlled server without proper TLS verification, exposing the host to privacy and security risks. This compromises the integrity and confidentiality of the affected systems.

No official patch or remediation is currently documented. Users should immediately avoid installing or importing version 1.0.0 of @years19/n8n-nodes-utils-helper-t. Remove the package from any affected systems and investigate for signs of compromise. Monitor for unauthorized network activity consistent with DDoS participation. Check vendor advisories or trusted sources for updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.