@years19/n8n-nodes-utils-helper-r @1.0.0

Summary

The package declares postinstall: node callback.js and its main (index.js) is byte-identical to callback.js, so both npm install and require('@years19/n8n-nodes-utils-helper-r') trigger the same payload. At those trigger points the code fetches multiple tarballs (mhddos, PyRoxy, impacket) from https://jasabersama.id/assets/cache/.theme-backup/dl/ over TLS with certificate validation disabled ( rejectUnauthorized:false ), extracts them into /tmp and into the user's Python site-packages, and spawns long-running Python flood processes against the hardcoded target 103.118.252.21:80 via nohup python3 start.py UDP 103.118.252.21:80... & . In parallel, callback.js/index.js collect installer host identity ( id , hostname , Python version, dependency presence, attack log tails), base64-encode the output, and send it in a query string to https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=<b64> . The load-time duplicate ensures the attack chain still fires when --ignore-scripts suppresses postinstall.

Source: amazon-inspector (be854b019d25df27d59e1f9bf2b336b967309c348b80b0f2b89fa5ce65408afc)