The package @years19/n8n-nodes-utils-helper-y (version 1.0.0) masquerades as a utility helper node for n8n workflow automation. Its postinstall hook and main module contain identical malicious code that writes a Python script to /tmp/attack2.py and executes it in the background. This script floods IP 103.118.252.21 on ports 80 and 443 with UDP/TCP traffic using 2000 threads for 900 seconds. Additionally, the package collects host identity information (uid, hostname, process/load info), base64-encodes it, and sends it via HTTPS GET to jasabersama.id/portfolio-data.php with TLS certificate verification disabled (rejectUnauthorized:false). The malicious code executes both on installation and whenever the package or n8n loads the node, enabling repeated execution.

The malicious package causes a denial-of-service style network flood attack against a remote IP address, potentially implicating the host in unwanted traffic generation. It also leaks sensitive host identity information to an attacker-controlled server, compromising confidentiality. The disabled TLS verification increases the risk of interception or manipulation of the exfiltrated data. This behavior can lead to reputational damage, network abuse, and potential further compromise depending on the collected data.

No official patch or remediation is currently documented. Users should immediately remove the package @years19/n8n-nodes-utils-helper-y version 1.0.0 from their environments and avoid installing or requiring it. Verify that no remnants of the malicious Python script or exfiltration processes remain on affected hosts. Monitor for any unusual network traffic originating from affected systems. Check vendor or repository advisories for updates or removal notices. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.