@years20/n8n-nodes-utils-helper-g @1.0.0

Summary

On npm install , the package's postinstall script (duplicated in the main module) executes shell commands to collect host identity ( id , hostname , pwd ), locates n8n installation directories, enumerates running n8n processes, and reads n8n-related environment variables. The collected output is base64-encoded and sent via HTTPS GET to the hardcoded endpoint https://jasabersama.id/portfolio-data.php with TLS certificate validation disabled ( rejectUnauthorized: false ). The request includes a static key parameter k=S7k9xQ2mZj and a c= parameter containing a shell command payload ( echo <base64> | base64 -d >> /tmp/n8n_rce_result.txt ), and the endpoint filename plus payload shape indicate an RCE staging harness. The package's advertised utility helper purpose is a cover; the only substantive content is the install-time recon and beacon.

Source: amazon-inspector (55ed8dc4c0467877e129dc4b2035e154dc4fec24bfda412d649fa02ed7150133)