Malicious code in @years17/n8n-nodes-helper-utils (npm)

The npm package @years17/n8n-nodes-helper-utils shipped with intentionally malicious code targeting n8n automation systems. The package contained three distinct attack vectors:\n\n1. Postinstall Script: A postinstall hook executed id and hostname commands at npm install time, writing output to /tmp/pwned.txt.\n\n2. Module Load Execution: The main index.js file executed system reconnaissance commands (id, hostname, uname -a, ls -la /home, cat /etc/hostname) at require() time, writing results to /tmp/n8n_pwned.txt. Comments in the code explicitly noted execution within n8n's main process with no sandbox isolation, exploiting n8n's auto-loading of community node packages on startup.\n\n3. Workflow Execution: The exported HelperUtils node's execute() function unconditionally ran additional reconnaissance commands (id, hostname, uname -a, ls -la /home, ls -la /) and returned output as node results labeled with pwned: true.\n\nThe self-identifying filenames and output flags indicate this was a proof-of-concept demonstration of supply chain attack capabilities against n8n deployments. The incident was identified and credited to the OpenSSF malicious-packages project.