Malicious code in @years17/n8n-nodes-utils-helper-d (npm)

The npm package @years17/n8n-nodes-utils-helper-d was published with malicious code designed to execute during installation and module import. The package name mimics a legitimate n8n community-node utility, suggesting typosquatting or impersonation.\n\nUpon installation, a postinstall hook executes node callback.js, with identical logic duplicated in index.js to ensure execution on require. The script uses execSync to enumerate sensitive host data including directory listings (/app, /opt, /home/ubuntu), process information (/proc/1/cmdline), system configuration (/etc/hosts), and internal DNS names (nexus.local, proxy.nexus.local). It also reads SSH authorized keys from /home/ubuntu/.ssh/authorized_keys.\n\nThe aggregated data is base64-encoded and transmitted via HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized: false). The request includes a c= parameter containing a base64-encoded shell command, with results written to /tmp/n8n_rce_result.txt, indicating a command-delivery and execution mechanism controlled by the attacker.\n\nThe targeting of nexus.local and SSH credentials suggests an active reconnaissance and credential-theft campaign against installer infrastructure, likely CI/CD systems or development environments.", <parameter name="remediation">["Immediately uninstall @years17/n8n-nodes-utils-helper-d from all systems", "Audit npm install logs and CI/CD pipelines for any installation of this package", "Rotate SSH keys and credentials that may have been exposed", "Review /tmp/n8n_rce_result.txt and system logs for evidence of command execution", "Block outbound connections to jasabersama.id", "Implement npm package verification and allowlisting in CI/CD pipelines", "Use npm audit and supply-chain security tools to detect similar malicious packages"]