The malicious npm package @years19/n8n-nodes-utils-helper-v version 1.0.0 includes a postinstall hook that runs node callback.js, which is identical in content to index.js, causing the payload to execute both on npm install and when the package is imported. The payload writes a Python script to /tmp/attack.py that launches approximately 650 threads to flood the IP 103.118.252.21 on ports 80 and 443 for 600 seconds. Concurrently, it collects system information such as user ID, hostname, process and load averages, base64-encodes this data, and sends it via an HTTPS GET request to https://jasabersama.id/portfolio-data.php with a query parameter containing the encoded data. This results in the infected host participating in an outbound DDoS attack and leaking sensitive host identity information to a remote attacker-controlled endpoint.

Hosts that install or import this package become unwitting participants in a distributed denial-of-service (DDoS) attack targeting a specific IP address, potentially causing network disruption. Additionally, sensitive system information is exfiltrated to an attacker-controlled server, which could aid in further attacks or reconnaissance. This compromises the confidentiality and availability of the affected systems.

No official patch or remediation is currently documented. Users should avoid installing or using version 1.0.0 of @years19/n8n-nodes-utils-helper-v. Remove the package if already installed and investigate any network traffic to the indicated IP address and domain. Monitor for signs of compromise and consider network-level blocking of connections to the attack target and data exfiltration endpoint. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.