@years19/n8n-nodes-utils-helper-w @1.0.0

Summary

The package's postinstall entry (callback.js) and its declared main entry (index.js) contain byte-identical top-level code that (1) writes a Python UDP/TCP flooding script to /tmp/attack2.py targeting the hardcoded IP 103.118.252.21 for 900 seconds and launches it via nohup python3 /tmp/attack2.py... & , and (2) collects the installer's shell id, hostname, /proc/loadavg and process listing, base64-encodes the blob, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php with TLS verification disabled ( rejectUnauthorized: false ). Both triggers fire automatically: the postinstall runs on npm install , and the identical main module runs again when n8n loads the community node via require() . The package presents itself as an n8n utility helper but ships no functional node code matching that purpose.

Source: amazon-inspector (a28114a258d77475252e0b9f61b21d3f82f8d7d9e2d37bbce9d4a70c2ff0bfa5)