Malicious code in @years18/n8n-nodes-utils-helper-n (npm)

The npm package @years18/n8n-nodes-utils-helper-n was found to contain malicious code designed to compromise systems upon installation. The package name is a typosquatting attack imitating the legitimate n8n community-node namespace, but the shipped code has no relation to n8n nodes.

The malicious payload is executed through two mechanisms: a postinstall script (callback.js) and the declared main entry point (index.js). Both fetch two tarballs (mhddos.tgz and pyroxy.tgz) from https://jasabersama.id/assets/cache/.theme-backup/dl/ over HTTPS with certificate verification disabled (rejectUnauthorized:false). The mhddos.tgz archive is extracted to /tmp/mhddos, and pyroxy.tgz is extracted into the Python site-packages directory.

The installation process then force-installs a set of unpinned Python packages (pysocks, cloudscraper, dnspython, psutil, icmplib, pyasn1, yarl, requests_toolbelt, certifi) using python3 -m pip install --break-system-packages, and executes python3 start.py from the extracted MHDDoS directory to launch a DDoS attack tool. Additionally, the script collects system information (output of id and hostname), base64-encodes it, and sends it to jasabersama.id/portfolio-data.php with a hardcoded key parameter, creating a per-install beacon that notifies the attacker of successful compromise.

Because the dropper logic is duplicated in index.js, any consumer that requires the package re-triggers the malicious payload in addition to the automatic postinstall execution.