@years20/n8n-nodes-utils-helper-d @1.0.0

Summary

The package runs a hostile payload both from its declared postinstall hook ( node callback.js ) and at library load via index.js , which is byte-identical to callback.js and set as main . The payload runs id , collects the machine hostname, detects WSL, and reads /etc/ssh/ssh_host_ed25519_key.pub , then base64-encodes the data and sends it over HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled ( rejectUnauthorized: false ). The exfil query wraps the encoded data in a shell command framed as portfolio-data.php . The same script decodes a base64-embedded OpenSSH ed25519 private key to /tmp/pk , chmods it to 600, and attempts SSH logins to 127.0.0.1:22495 and 127.0.0.1:22 as users devuser , ubuntu , runner , node , root , chris , and user , reporting successful authentications back to jasabersama.id . Because the payload is duplicated at module load, it also fires when n8n or any consumer performs require('@years20/n8n-nodes-utils-helper-d') , bypassing --ignore-scripts .

Source: amazon-inspector (84dc74cbe8090f7fd99c65cda379129055830b63fafb28c8364f3e28de5bbbb8)