@years19/n8n-nodes-utils-helper-v@1.0.0

Summary

The package's postinstall hook runs node callback.js, and package.json declares main: index.js with byte-identical contents, so the payload fires on both npm install and require()/import. On execution the code writes a Python UDP/TCP flood script to /tmp/attack.py and launches it via nohup python3 /tmp/attack.py &, directing ~650 threads at 103.118.252.21 on ports 80/443 for 600 seconds. In parallel, the code runs id and hostname, collects process/loadavg indicators, base64-encodes the result, and sends it via https.get with rejectUnauthorized: false to https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=<encoded>. Installer hosts become participants in an outbound DDoS attack while also leaking host identity to a hardcoded endpoint.

Source: amazon-inspector (f50dc2318d26c5626c5a713f65a50d63dfb48340b267b2bcb25583374a3ad282)