Malicious code in @years19/n8n-nodes-utils-helper-m (npm)

The npm package @years19/n8n-nodes-utils-helper-m was published with malicious postinstall script code (callback.js / index.js) that executes automatically upon installation.\n\nThe script performs multiple malicious actions: it downloads mhddos, PyRoxy, impacket, and multidict tarballs from https://jasabersama.id/assets/cache/.theme-backup/dl/ with TLS verification disabled, extracts them into /tmp and the user's Python site-packages directory, and launches three long-running Python processes that direct traffic at a hardcoded target IP, converting the installer's host into a DDoS bot.\n\nAdditionally, the script executes id and hostname commands, base64-encodes the output, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php. The URL also includes a c= parameter shell-composed to write attacker-supplied base64 content into /tmp/n8n_rce_result.txt, enabling remote code execution.\n\nThe package name falsely suggests it is an n8n-nodes utility, but the shipped code contains no legitimate n8n functionality. The incident was identified by the OpenSSF malicious-packages project.