Malicious code in @years19/n8n-nodes-utils-helper-d (npm)

The package @years19/n8n-nodes-utils-helper-d was published to npm as a purported n8n community node but contained a malicious postinstall script. Upon installation, the script fetches a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz with TLS certificate validation disabled and extracts it into the Python site-packages directory, shadowing the legitimate multidict module.\n\nWhen the Python environment subsequently imports multidict, it executes attacker-supplied code. Follow-up shell activity references PyRoxy/impacket and /tmp/mhddos/start.py, consistent with a DDoS and offensive-tooling dropper. The postinstall script also executes system reconnaissance commands (id, hostname), base64-encodes the output along with probes for dropped Python libraries, and sends the result via GET request to https://jasabersama.id/portfolio-data.php with a hardcoded key parameter, beaconing the installer's host identity to the attacker.\n\nThe shipped node file is a stub named PwnNode.node.js with no legitimate n8n node functionality. This represents a supply chain attack combining typosquatting (impersonating a legitimate n8n node), malicious package distribution, and multi-stage payload delivery targeting both Node.js and Python environments.