Malicious code in @years18/n8n-nodes-utils-helper-l (npm)

The npm package @years18/n8n-nodes-utils-helper-l was published with malicious code embedded in both its postinstall script (callback.js) and main module (index.js). The code is byte-identical in both locations, functioning as a dropper that activates on package installation and on any require() call.\n\nUpon execution, the dropper fetches https://jasabersama.id/assets/cache/.theme-backup/dl/mhddos.tgz and get-pip.py over HTTPS with certificate validation explicitly disabled (rejectUnauthorized:false). It extracts the payload to /tmp/mhddos, installs Python dependencies using pip with the --break-system-packages flag, and executes python3 start.py from the archive—launching an mhddos DDoS toolkit.\n\nThe malicious code also collects host identifiers including id, hostname, WSL/VM/container classification, $HOME, and command outputs. These are base64-encoded and sent as a query parameter to https://jasabersama.id/portfolio-data.php with a hardcoded key. Because package.json declares main:index.js, the dropper fires automatically when the package is required, including when n8n's runtime loads community nodes.\n\nThe destination host is not the legitimate package publisher's registry, the fetched payload is unpinned and unverified, and TLS validation is deliberately disabled—all indicators of intentional malicious compromise.