The malicious npm package @years19/n8n-nodes-utils-helper-w version 1.0.0 includes identical top-level code in its postinstall script and main module. This code writes a Python UDP/TCP flood attack script to /tmp/attack2.py targeting IP 103.118.252.21 for 900 seconds and executes it in the background. Concurrently, it collects sensitive system information such as the shell ID, hostname, /proc/loadavg, and running processes, base64-encodes this data, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php with TLS certificate verification disabled. Both the postinstall and main module triggers run automatically during npm install and when the package is required by n8n, respectively. The package falsely advertises itself as an n8n utility helper but contains no legitimate node code.

This malicious package can cause a denial-of-service attack on a remote target via UDP/TCP flooding, potentially contributing to network disruption. It also compromises the security and privacy of the host system by exfiltrating sensitive system information to an attacker-controlled server. The disabling of TLS verification increases the risk of man-in-the-middle interception during data exfiltration. The automatic execution on install and runtime increases the likelihood of infection without user awareness.

No official patch or remediation is currently available for this package. Users should avoid installing or using @years19/n8n-nodes-utils-helper-w version 1.0.0. Remove the package immediately if installed. Monitor for unusual network traffic and system behavior indicative of the described attack. Consider using trusted sources and verifying package integrity before installation.