@years19/n8n-nodes-utils-helper-x @1.0.0

Summary

The package's postinstall hook runs node callback.js, and package.json declares main=index.js which is byte-identical to callback.js, so both npm install and require() of the package execute the same payload. The payload writes /tmp/attack2.py — a threaded UDP/TCP flood loop targeting 103.118.252.21 for 900 seconds — and launches it via nohup python3 /tmp/attack2.py & , weaponizing the installer's host and IP as a DDoS bot. In parallel, it collects the output of id , hostname , a process check and /proc/loadavg, base64-encodes it, and sends it over HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized:false). The package is presented as an n8n utility helper but ships no such functionality; its only observable behavior is the DDoS launcher and host-identity beacon.

Source: amazon-inspector (da3601885350a7fc85f418da9fb3f800a5e76949562ad23ac44d5c2b068088c4)