@years18/n8n-nodes-utils-helper-o

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (5b7ec0fd707d50145d85051b5c960139ebe64dc5f12c89ee22ecfa8402d169c4)
The package presents itself as an n8n community node but ships a stub node file (nodes/PwnNode.node.js, 213 bytes, description "x") whose only real behavior is a postinstall dropper. On install, callback.js fetches two tarballs from jasabersama.id over HTTPS with TLS verification disabled (rejectUnauthorized: false), extracts one to /tmp/mhddos and the other into the user's Python site-packages, installs a list of Python DDoS-support dependencies via pip with --break-system-packages, then executes `python3 start.py` from the extracted MHDDoS archive. The same script runs `id` and `hostname`, base64-encodes the output along with install-progress markers, and sends it via HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled. The declared n8n utility purpose is a cover story for the install-time payload.

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.