@years18/n8n-nodes-utils-helper-m@1.0.0

Summary

The package's declared postinstall script (node callback.js) and its main entrypoint (index.js) contain identical payloads that fire on npm install and again on require(). The payload downloads a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/pyroxy.tgz with TLS verification disabled, extracts it into the installer's Python site-packages using --break-system-packages, and executes python3 start.py from /tmp/mhddos (the mhddos / PyRoxy DDoS tool). The same code collects the installer's user id, hostname, and command-execution output, base64-encodes them, and sends them as a query parameter to https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=..., again with rejectUnauthorized: false. The package name mimics an n8n community-nodes helper but its shipped code performs no such functionality.

Source: amazon-inspector (5db497bbce490daad792ade6e502a9d382634c48047a6be6fcf31fd731bf6a53)