Malicious code in @years19/n8n-nodes-utils-helper-y (npm)

The package @years19/n8n-nodes-utils-helper-y was published to npm with malicious intent, disguised as a legitimate n8n community utility helper node. The package.json declared a postinstall hook and a main entry point, both containing identical malicious code.\n\nUpon installation or when the package is required, the malicious code executes in two stages: (1) it writes a Python script to /tmp/attack2.py and launches it via nohup, which floods the IP address 103.118.252.21 on ports 80 and 443 with UDP/TCP traffic using 2000 threads for 900 seconds; and (2) it collects host identity information including uid, hostname, and process/load data, base64-encodes it, and sends it over HTTPS GET to jasabersama.id/portfolio-data.php with TLS certificate verification disabled.\n\nBecause the malicious code is present in both the postinstall script and the top-level module code, it executes both during npm install and every time a consumer requires the package or n8n loads the node, creating persistent compromise.\n\nThe incident was identified and reported by the OpenSSF malicious-packages project.