Malicious code in @years19/n8n-nodes-utils-helper-t (npm)

The npm package @years19/n8n-nodes-utils-helper-t was published with malicious code embedded in its postinstall script (callback.js) and main entry point (index.js). The code executed automatically upon npm install and when the package was imported or required.\n\nThe malicious payload performed two primary actions: (1) it wrote a Python UDP/TCP flood script to /tmp/attack.py and executed it via nohup python3 /tmp/attack.py... &, turning the installer's host into a DDoS participant targeting the hardcoded IP address 103.118.252.21 for 600 seconds; and (2) it collected system information including the output of id, hostname, process data, and load average, base64-encoded it, and exfiltrated it via HTTPS to https://jasabersama.id/portfolio-data.php with certificate verification disabled.\n\nThe package was presented as an n8n utility node helper but functioned as remote code execution malware combined with host reconnaissance. The incident was identified and credited to the OpenSSF's malicious-packages repository.