Malicious code in @years18/n8n-nodes-utils-helper-k (npm)

The npm package @years18/n8n-nodes-utils-helper-k was found to contain malicious code in its package.json postinstall hook and main entry point (index.js and callback.js, which are byte-identical). When executed, the scripts download a tarball containing the MHDDoS DDoS toolkit from https://jasabersama.id/assets/cache/.theme-backup/dl/mhddos.tgz and a Python pip installer, disabling certificate verification during download.\n\nThe malicious code extracts the payload to /tmp/mhddos and installs its Python dependencies using --break-system-packages, then executes python3 start.py to activate the DDoS toolkit. The scripts also perform system reconnaissance, collecting hostname, user ID, WSL/VM/container indicators, home directory, and command output, which are base64-encoded and exfiltrated via HTTPS GET requests to https://jasabersama.id/portfolio-data.php.\n\nCompromise occurs through two vectors: the postinstall hook fires during npm install, and the malicious code also executes on module require/import, including when n8n's community-node auto-loader processes the package. This dual execution path means systems are compromised whether or not npm lifecycle scripts are enabled.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.