@years18/n8n-nodes-utils-helper-j

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (c17b5de9890a54a8a7a1ddf14ff05488baa64612904cf577591e1b9f9a007f1a)
The package ships a postinstall hook (`node callback.js`) and a main entrypoint (`index.js`, byte-identical to callback.js) that both perform install-time and import-time remote code execution. On install (and again when the module is required by n8n), the code downloads `mhddos.tgz` and `get-pip.py` from https://jasabersama.id/assets/cache/.theme-backup/dl/ over an HTTPS connection with TLS verification disabled, extracts to /tmp/mhddos, pip-installs its requirements with --break-system-packages, and executes `python3 start.py` — the MHDDoS DDoS tool. Before the drop, callback.js/index.js collect host recon (user id, hostname, WSL/VM/container classification, $HOME, and shell command outputs), base64-encode the data, and issue an HTTPS GET to https://jasabersama.id/portfolio-data.php with the recon in the `c` query parameter. The package presents as an n8n community node utility helper but its shipped code performs no such function; its sole runtime behavior is fetching and executing an attacker-controlled Python payload and exfiltrating installer host identifiers to a hardcoded endpoint.

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.