Malicious code in @years19/n8n-nodes-utils-helper-r (npm)

The npm package @years19/n8n-nodes-utils-helper-r was published with embedded malicious code designed to execute at multiple trigger points. The package's postinstall script and main entry point (index.js) were byte-identical, ensuring the payload executed both during npm install and when the module was required, even when postinstall scripts were disabled via --ignore-scripts.\n\nUpon execution, the malicious code fetched multiple tarballs (mhddos, PyRoxy, impacket) from https://jasabersama.id/assets/cache/.theme-backup/dl/ with TLS certificate validation disabled, extracted them into /tmp and the user's Python site-packages directory, and spawned long-running Python flood processes targeting 103.118.252.21:80 via UDP. In parallel, the code collected system information including user ID, hostname, Python version, installed dependencies, and attack logs, base64-encoded the data, and exfiltrated it to https://jasabersama.id/portfolio-data.php.\n\nThe attack was identified by the OpenSSF's malicious-packages project and attributed to Amazon Inspector detection. The package represents a supply chain compromise delivering DDoS malware and system reconnaissance capabilities to any system that installed it.