Malicious code in @years19/n8n-nodes-utils-helper-i (npm)

The npm package @years19/n8n-nodes-utils-helper-i was published with malicious code embedded in both its postinstall script and main entry point (index.js). Upon installation or import, the package executes callback.js, which downloads four tarballs (mhddos, pyroxy-full, impacket, multidict) from an attacker-controlled domain (jasabersama.id) with TLS verification disabled.\n\nThe malicious script then spawns python3 start.py to launch UDP/TCP/GET flood traffic against the hardcoded target IP 103.118.252.21. In parallel, it collects system reconnaissance data including user ID, hostname, dependency-check output, process list, and attack logs, base64-encodes them, and exfiltrates the data via HTTPS GET requests to jasabersama.id/portfolio-data.php.\n\nBecause the malicious code is present in both the postinstall hook and the main entry point, any installation or require/import of the module triggers the compromise. The package was identified by the OpenSSF malicious-packages project and credited to Amazon Inspector.\n\nThis is a clear supply chain attack using a typosquatting or lookalike package name to target users seeking n8n node utilities.