Malicious code in @years17/n8n-nodes-utils-helper-g (npm)

The npm package @years17/n8n-nodes-utils-helper-g was published with embedded malicious code designed to compromise host systems and enable persistent remote access.\n\nThe package's postinstall hook executes callback.js, which appends an attacker-controlled SSH public key (labeled pwn@kali) to /home/ubuntu/.ssh/authorized_keys, granting persistent SSH access. The same script performs host reconnaissance including user ID, hostname, sudo privileges, Docker socket access, and internal network resolution, then base64-encodes and exfiltrates this data via HTTPS to jasabersama.id/portfolio-data.php with certificate verification disabled.\n\nAdditionally, the package includes nodes/PwnNode.node.js, a malicious n8n node that executes system commands (id, hostname, uname, ls) via child_process.execSync and returns results as JSON, providing a post-exploitation primitive for any workflow using the node.\n\nThe attack was identified by the OpenSSF malicious-packages project and attributed to Amazon Inspector scanning.", <parameter name="remediation">["Immediately uninstall @years17/n8n-nodes-utils-helper-g from all systems", "Audit /home/ubuntu/.ssh/authorized_keys and remove any unauthorized SSH keys, particularly those labeled pwn@kali", "Review system logs and network traffic for connections to jasabersama.id", "Rotate SSH keys and credentials on affected systems", "Scan systems for persistence mechanisms and unauthorized access", "Review n8n workflows for use of PwnNode.node.js and remove if present", "Update npm dependencies and use npm audit to identify similar malicious packages"]