@years19/n8n-nodes-utils-helper-g @1.0.0

Summary

The package's postinstall script (callback.js) and its declared main entrypoint (index.js) contain byte-identical dropper code that runs on npm install and on require of the module. The code downloads multiple tarballs (mhddos.tgz, pyroxy-full.tgz, impacket.tgz, multidict) from https://jasabersama.id with TLS verification disabled (rejectUnauthorized:false), extracts them to /tmp/mhddos and the Python user-site directory, and invokes python3 start.py on the extracted payload. The same code collects the output of id and hostname along with execution results, base64-encodes the buffer, and transmits it via HTTPS GET to https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=<payload>. The fetched tooling (mhddos, PyRoxy, impacket) is offensive network-attack software staged and launched on the installer's host at install time.

Source: amazon-inspector (9ee748f84613cc36319702d58eb2ce50d87de1a1889a639d2004ddd03226bef7)