@years18/n8n-nodes-utils-helper-j @1.0.0

Summary

The package ships a postinstall hook ( node callback.js ) and a main entrypoint ( index.js , byte-identical to callback.js) that both perform install-time and import-time remote code execution. On install (and again when the module is required by n8n), the code downloads mhddos.tgz and get-pip.py from https://jasabersama.id/assets/cache/.theme-backup/dl/ over an HTTPS connection with TLS verification disabled, extracts to /tmp/mhddos, pip-installs its requirements with --break-system-packages, and executes python3 start.py — the MHDDoS DDoS tool. Before the drop, callback.js/index.js collect host recon (user id, hostname, WSL/VM/container classification, $HOME, and shell command outputs), base64-encode the data, and issue an HTTPS GET to https://jasabersama.id/portfolio-data.php with the recon in the c query parameter. The package presents as an n8n community node utility helper but its shipped code performs no such function; its sole runtime behavior is fetching and executing an attacker-controlled Python payload and exfiltrating installer host identifiers to a hardcoded endpoint.

Source: amazon-inspector (c17b5de9890a54a8a7a1ddf14ff05488baa64612904cf577591e1b9f9a007f1a)