If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (da3601885350a7fc85f418da9fb3f800a5e76949562ad23ac44d5c2b068088c4)
The package's postinstall hook runs node callback.js, and package.json declares main=index.js which is byte-identical to callback.js, so both npm install and require() of the package execute the same payload. The payload writes /tmp/attack2.py — a threaded UDP/TCP flood loop targeting 103.118.252.21 for 900 seconds — and launches it via `nohup python3 /tmp/attack2.py &`, weaponizing the installer's host and IP as a DDoS bot. In parallel, it collects the output of `id`, `hostname`, a process check and /proc/loadavg, base64-encodes it, and sends it over HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized:false). The package is presented as an n8n utility helper but ships no such functionality; its only observable behavior is the DDoS launcher and host-identity beacon.