@years20/n8n-nodes-utils-helper-h @1.0.0

Summary

Package presents itself as an n8n community utility node but ships only a 213-byte no-op node file (nodes/PwnNode.node.js, self-labeled 'Pwn'). The real behavior is in callback.js (invoked via scripts.postinstall and byte-identical to the package's main index.js): it shells out to gather host reconnaissance (id, hostname, git and node versions, n8n install paths, contents of ~/.n8n), base64-encodes the output, and transmits it over HTTPS GET to a hardcoded endpoint at https://jasabersama.id/portfolio-data.php with a fixed key parameter and TLS certificate verification disabled (rejectUnauthorized:false). The URL's c= parameter smuggles a shell pipeline ( echo <base64> | base64 -d >> /tmp/n8n_rce_result.txt ) indicative of C2-style tasking. The exfil fires automatically on npm install and again on any require() of the package.

Source: amazon-inspector (96661ee04dc82c36bfa5683fc33f6d7a29d10d1e1bc21ece83ea4189dcf33ef3)