Malicious code in @years19/n8n-nodes-utils-helper-v (npm)

The npm package @years19/n8n-nodes-utils-helper-v was found to contain malicious code that executes via a postinstall hook and through the main entry point. The payload writes a Python UDP/TCP flood script to /tmp/attack.py and launches it, directing approximately 650 threads at IP 103.118.252.21 on ports 80 and 443 for 600 seconds.\n\nIn parallel, the malicious code executes system reconnaissance commands (id and hostname), collects process and load average indicators, base64-encodes the results, and exfiltrates this data via HTTPS to https://jasabersama.id/portfolio-data.php with a hardcoded query parameter. The code disables certificate validation during exfiltration.\n\nAny system that installs the package or imports it becomes an unwitting participant in an outbound DDoS attack while simultaneously leaking host identity information to an attacker-controlled endpoint. The incident was identified and credited to the OpenSSF malicious packages project.