@years20/n8n-nodes-utils-helper-a @1.0.0

Summary

The package's postinstall script (callback.js) and its main module (index.js, byte-identical to callback.js) execute on both npm install and require() . They shell out to collect id , hostname , WSL indicators, and the local SSH host-key fingerprint, base64-encode the recon output, and send it to a hardcoded endpoint at https://jasabersama.id/portfolio-data.php with rejectUnauthorized: false . The payload also decodes an embedded base64 OpenSSH ed25519 private key to /tmp/pk (chmod 600) and iterates common local account names ( devuser , ubuntu , runner , node , root , chris , user ) attempting SSH into 127.0.0.1:22495 and 127.0.0.1:22 , reporting successful logins back to the same external host. The exfil query string carries a URL-encoded shell command that the receiving PHP handler is expected to execute, indicating a server-side command channel. The trigger fires automatically at install time via scripts.postinstall and again whenever a consumer (e.g. n8n loading this custom node) imports the module.

Source: amazon-inspector (53efd1db4158ab9b9fbc01983ff03019e4938eb54329876135b5eb4a0ba927bc)