@years19/n8n-nodes-utils-helper-y @1.0.0

Summary

The package advertises itself as an n8n community utility helper node (package.json declares n8n.nodes: ["nodes/PwnNode.node.js"] with description 'Utility helper nodes for workflow automation'), but its callback.js (invoked from the declared postinstall hook node callback.js ) and its main entry index.js contain identical top-level code that: (1) writes a Python script to /tmp/attack2.py and launches it via nohup python3 /tmp/attack2.py... & , which floods 103.118.252.21 on ports 80/443 with UDP/TCP traffic using 2000 threads for 900 seconds; and (2) collects host identity (uid, hostname, process/load information), base64-encodes it, and sends it over HTTPS GET to jasabersama.id/portfolio-data.php with TLS certificate verification disabled (rejectUnauthorized:false). Because the dropper is both in the postinstall script and at the top level of the main module, it executes on npm install and again every time a consumer require s the package or n8n loads the node.

Source: amazon-inspector (39f5f361848c187cd60f9143d0bdc5d2db20a3e2fa03fe5e494697da05c4a42a)