If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (85113dcbea98d25a66f14a975ab391a33a72964b38c916b386125857e35ca268)
On npm install, the package's postinstall script (callback.js / index.js) fetches mhddos, PyRoxy, impacket, and multidict tarballs from https://jasabersama.id/assets/cache/.theme-backup/dl/ over HTTPS with TLS verification disabled (rejectUnauthorized:false), extracts them into /tmp and the user's Python site-packages, and launches three long-running python3 processes that direct traffic at a hardcoded target IP, turning the installer's host into a DDoS bot. The same script runs `id` and `hostname`, base64-encodes the output, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php, with the URL also carrying a `c=` parameter shell-composed to write attacker-supplied base64 content into /tmp/n8n_rce_result.txt. The package name suggests an n8n-nodes utility but the shipped code contains no such functionality.