Malicious code in @years18/n8n-nodes-utils-helper-d (npm)

The npm package @years18/n8n-nodes-utils-helper-d was published as a purported n8n community node but contained malicious code designed to compromise the installer's system. The package's node file (nodes/PwnNode.node.js) was a stub; the actual malicious behavior was implemented in callback.js, which was automatically executed via the postinstall lifecycle hook.\n\nOn installation, callback.js performed three attacker-controlled actions: (1) it downloaded https://jasabersama.id/assets/cache/.theme-backup/dl/mhddos.tgz with certificate validation disabled, extracted it, installed its Python dependencies, and executed start.py—providing unattended remote code execution of a mutable third-party archive associated with the mhddos DDoS tool family; (2) it executed system reconnaissance commands (id, hostname) and probed an internal TCP endpoint, then base64-encoded and exfiltrated the results to https://jasabersama.id/portfolio-data.php, leaking installer identity and network topology; (3) it executed bash commands against a hardcoded RFC1918 address (10.131.106.93:8888) with a source comment referencing Sliver, an offensive C2 framework, and reported reachability back—consistent with lateral-movement staging.\n\nThe same payload was duplicated in index.js to ensure execution on module require. The package was identified via Amazon Inspector and published to GitHub advisories."