Malicious code in @years18/n8n-nodes-utils-helper-s (npm)

The npm package @years18/n8n-nodes-utils-helper-s was published with malicious code embedded in its postinstall lifecycle script. The package name was designed to mimic legitimate n8n community node packages, representing a typosquatting attack.

Upon installation, the postinstall script downloads two tarballs (mhddos.tgz and pyroxy.tgz) from jasabersama.id over HTTPS with TLS verification disabled (rejectUnauthorized:false). These archives are extracted to /tmp and into the Python user site-packages directory. The script then pip-installs a fixed dependency set with the --break-system-packages flag and immediately executes python3 start.py from the extracted mhddos directory.

In parallel, the malicious code collects system information including the output of id and hostname commands, along with install-progress markers. This data is base64-encoded and exfiltrated to https://jasabersama.id/portfolio-data.php as a query-string parameter using a fixed key S7k9xQ2mZj. The payload URL is staged under a .theme-backup/dl/ path on a domain unrelated to the package's declared purpose.

The package's n8n node file is a non-functional stub; all actual functionality is contained in the malicious postinstall script. This incident was identified and credited to the OpenSSF malicious-packages repository.