Malicious code in @years19/n8n-nodes-utils-helper-j (npm)

The npm package @years19/n8n-nodes-utils-helper-j was published with embedded malicious code that executes automatically during installation (via postinstall hook) and on any require() call. The payload is identical in both callback.js and index.js (the declared main entry point).\n\nThe malicious code performs two primary functions: (1) It downloads multiple tarballs (mhddos, PyRoxy, impacket, multidict) from https://jasabersama.id with TLS certificate verification disabled, extracts them to /tmp and the user's site-packages directory, and spawns Python3 processes that flood a hardcoded target at 103.118.252.21 with UDP, TCP, and HTTP traffic; (2) It collects system information including the output of id and hostname commands, dependency status, and attack logs, base64-encodes them, and exfiltrates them to https://jasabersama.id/portfolio-data.php as query parameters.\n\nThe disabling of TLS certificate verification (rejectUnauthorized:false) without certificate pinning makes the transport vulnerable to man-in-the-middle attacks and allows the attacker to maintain control even if the attacker's infrastructure is compromised. Any system that installs or imports this package becomes a DDoS bot under the installer's user account and leaks host identity to the attacker.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.