Malicious code in @years19/n8n-nodes-utils-helper-o (npm)

The npm package @years19/n8n-nodes-utils-helper-o was published with embedded malicious code designed to conduct distributed denial-of-service attacks. The package name was crafted to mimic a legitimate n8n community node, increasing the likelihood of installation by users seeking n8n extensions.\n\nUpon installation, the package's postinstall hook executes callback.js, which downloads Python DDoS tooling (mhddos, PyRoxy, impacket, multidict) from https://jasabersama.id/assets/cache/.theme-backup/dl/ with TLS certificate validation disabled. The same malicious payload is embedded in index.js (the declared main entry point) and re-executes on package require. The downloaded tools are extracted to /tmp and the user's site-packages directory, then three detached Python processes are spawned to flood the target IP 103.118.252.21 across UDP/80, TCP/443, and GET/80.\n\nThe malware also executes system reconnaissance commands (id, hostname), base64-encodes the output along with attack process status, and exfiltrates this data to https://jasabersama.id/portfolio-data.php via a hardcoded key over the same TLS-verification-disabled connection. In n8n instances with automatic node loading enabled, importing the package re-triggers the payload, amplifying the attack surface.\n\nThe incident was identified and reported by the OpenSSF malicious-packages project.