GCVE-110-OSM-2026-10283

This package is part of a distributed denial of services bot network and DDoS-toolkit installer disguised as n8n utility nodes. The first thing it does is identify and exfil sensitive system and user data to an Indonesian website controlled by the attacker. The next stage involves compromising developers machines, adding a persistence mechanism and adding these victims to the DDoS botnet. On postinstall, callback.js runs immediately via node, executes 'id' and 'hostname' to fingerprint the victim, fetches a tarball from an attacker-controlled endpoint, and installs it into the Python user site-packages directory, then checks for PyRoxy, impacket, and MHDDoS — a well-known DDoS attack framework — confirming the attacker's goal is to silently enlist developer machines into a DDoS botnet. System reconnaissance output is base64-encoded and exfiltrated to an attacker controlled URL with a hardcoded key. ENTRY callback.js (install-hook: node callback.js) - Install Hook Executes Local JS File in package.json EXFIL - Data Encoding for Exfiltration in callback.js: "encodeURIComponent('echo ' + b64 + ' | base64 -d >> /tmp/n8n_rce_result.txt" - Data Encoding for Exfiltration in index.js: "encodeURIComponent('echo ' + b64 + ' | base64 -d >> /tmp/n8n_rce_result.txt" - Network Request in callback.js: "https.get(" - Network Request in index.js: "https.get(" ADDITIONAL FINDINGS - Shell Command Execution in callback.js: "require('child_process')" - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES callback.js (+ index.js)