@years20/n8n-nodes-utils-helper-d@1.0.0

Summary

The package runs a hostile payload both from its declared postinstall hook (node callback.js) and at library load via index.js, which is byte-identical to callback.js and set as main. The payload runs id, collects the machine hostname, detects WSL, and reads /etc/ssh/ssh_host_ed25519_key.pub, then base64-encodes the data and sends it over HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized: false). The exfil query wraps the encoded data in a shell command framed as portfolio-data.php. The same script decodes a base64-embedded OpenSSH ed25519 private key to /tmp/pk, chmods it to 600, and attempts SSH logins to 127.0.0.1:22495 and 127.0.0.1:22 as users devuser, ubuntu, runner, node, root, chris, and user, reporting successful authentications back to jasabersama.id. Because the payload is duplicated at module load, it also fires when n8n or any consumer performs require('@years20/n8n-nodes-utils-helper-d'), bypassing --ignore-scripts.

Source: amazon-inspector (84dc74cbe8090f7fd99c65cda379129055830b63fafb28c8364f3e28de5bbbb8)