@years18/n8n-nodes-utils-helper-v

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (9923595138c727382a8b1e870530f6d55ded8a052ee374569ad8b87b1560c07f)
The package masquerades as an n8n community node (name @years18/n8n-nodes-utils-helper-v, node file nodes/PwnNode.node.js with an empty 'x' description) while the real behavior is in a postinstall dropper. On npm install the postinstall script collects host identity (`id`, hostname) via callback.js, base64-encodes the result, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized:false). The same postinstall path installs the impacket network-attack library via `pip install --break-system-packages`, probes PyRoxy, and attempts to execute /tmp/mhddos/start.py (MHDDoS). Installing this package auto-runs reconnaissance, exfiltrates installer host identifiers to a hardcoded third-party endpoint, and stages offensive DDoS/network-attack tooling on the installer's machine.

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.