@years20/n8n-nodes-utils-helper-b @1.0.0

Summary

On npm install (postinstall) and on require/import of the package's main entry, callback.js and index.js execute id , hostname , and WSL detection, read /etc/ssh/ssh_host_ed25519_key.pub , base64-encode the collected data, and GET it to https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=<base64-command> with TLS verification disabled ( rejectUnauthorized: false ). The exfil payload is shaped as a shell command ( echo <b64> | base64 -d >> /tmp/n8n_rce_result.txt ) consistent with a replayable C2 handler. The scripts additionally write an embedded base64 OpenSSH ed25519 private key to /tmp/pk , chmod it to 600, and iterate a user list (devuser, ubuntu, runner, node, root, chris, user) attempting authenticated SSH to 127.0.0.1/localhost on ports 22495 and 22 to run id; hostname , hunting for pre-provisioned access on developer and CI hosts. Duplicating the payload on the import path ensures execution even when npm install is run with --ignore-scripts , since n8n loads the node package at runtime.

Source: amazon-inspector (5f282ccd8bb4c80e0316cecf2a9294b7f183bb2339cca52ff72508f2978f2e60)