Malicious code in @years18/n8n-nodes-utils-helper-u (npm)

The npm package @years18/n8n-nodes-utils-helper-u was published with malicious code embedded in its postinstall script. The script executed unconditionally upon package installation, running system reconnaissance commands (id and hostname) and base64-encoding the output for transmission to a remote endpoint at jasabersama.id/portfolio-data.php with TLS certificate validation disabled.\n\nBeyond reconnaissance, the postinstall hook installed the Python impacket library system-wide using pip --break-system-packages and invoked /tmp/mhddos/start.py, an MHDDoS attack launcher. This weaponized the installer's host for outbound denial-of-service activity against third-party targets.\n\nThe malicious script also established a command-staging channel via a c= query parameter, allowing the attacker to decode and execute arbitrary shell commands with results written to /tmp/n8n_rce_result.txt. The attack was discovered and reported by the OpenSSF malicious-packages project.\n\nAny system that installed this package during its availability was compromised with reconnaissance, DDoS capabilities, and remote code execution potential.