The package @years19/n8n-nodes-utils-helper-u version 1.0.0 includes a postinstall hook and main entry script that write a Python script to /tmp/attack.py and execute it in the background. This script performs a distributed denial-of-service (DDoS) attack by flooding the target IP 103.118.252.21 with UDP and TCP traffic for 600 seconds. Additionally, the malicious code collects system information such as host ID, hostname, running process count, and load average, base64-encodes this data, and sends it via an HTTPS GET request to jasabersama.id with TLS verification disabled. Because the malicious code runs both on install and whenever the package is required, any use of this package or its loading as an n8n community node triggers the attack and data exfiltration.

Hosts that install or require this package become unwitting participants in a DDoS attack against a third-party IP address, potentially exposing them to legal and reputational risks. The attack consumes system resources and network bandwidth during the 600-second flood period. The exfiltration of host identifiers to an external server without TLS verification poses a privacy and security risk, potentially exposing sensitive system information to attackers.

No official patch or remediation is currently available for this malicious package version. Users should immediately uninstall and avoid using @years19/n8n-nodes-utils-helper-u version 1.0.0. Verify the integrity and source of npm packages before installation, and consider using package integrity verification tools or trusted registries. Monitor for any unexpected network activity indicative of DDoS participation and remove the malicious package if detected.