@years20/n8n-nodes-utils-helper-e @1.0.0

Summary

The package presents as an n8n community-nodes helper but ships a malicious postinstall script (callback.js) and a byte-identical main entrypoint (index.js) that fire on npm install and on module load. The script runs id , hostname , and WSL detection, reads the host SSH public key fingerprint from /etc/ssh/ssh_host_ed25519_key.pub, base64-encodes the collected data, and sends it via HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled ( rejectUnauthorized: false ). It also decodes a bundled OpenSSH ed25519 private key to /tmp/pk (chmod 600) and iterates ssh -i /tmp/pk login attempts against 127.0.0.1/localhost on ports 22495 and 22 as devuser/ubuntu/runner/node/root/chris/user, executing id; hostname on any account that accepts the key. The C2 URL path /portfolio-data.php?k=S7k9xQ2mZj&c=<url-encoded shell command> is shaped as a command channel, indicating the endpoint is dual-use exfiltration and remote-execution infrastructure.

Source: amazon-inspector (89d61386ef6d8694ecf5f0578b5fe77156f475f76a8e97a1b2e834821cfbe0df)