Malicious code in @years18/n8n-nodes-utils-helper-e (npm)

The npm package @years18/n8n-nodes-utils-helper-e was published with malicious code designed to execute automatically during installation and when the module is required. The package masqueraded as a utility helper for n8n but contained only malicious functionality.\n\nUpon installation, the package executed a postinstall hook that ran callback.js, which was also repeated in index.js on require. The script downloaded and executed pip from /tmp/get-pip.py, then installed and launched the mhddos DDoS toolkit from /tmp/mhddos using python3 start.py. The malware also probed an internal network address at 10.131.106.93:8888.\n\nThe package collected system information including the output of id and hostname commands, base64-encoded the results, and exfiltrated them to https://jasabersama.id/portfolio-data.php with TLS verification disabled. The URL included a c= parameter containing shell commands written to /tmp/n8n_rce_result.txt, implementing a keyed command channel (k=S7k9xQ2mZj) consistent with a staged remote code execution relay controlled by the attacker.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.", <parameter name="remediation">["Immediately uninstall @years18/n8n-nodes-utils-helper-e from all systems", "Audit npm install logs to identify all systems that installed this package", "Scan affected systems for the presence of /tmp/mhddos, /tmp/get-pip.py, and /tmp/n8n_rce_result.txt", "Review network logs for connections to 10.131.106.93:8888 and https://jasabersama.id/portfolio-data.php", "Check for unauthorized processes or DDoS toolkit execution on affected systems", "Review system logs for unexpected id and hostname command execution", "Implement npm package verification and scanning in CI/CD pipelines", "Monitor for similar typosquatting packages targeting n8n utilities"]