Malicious code in @years17/n8n-nodes-utils-helper (npm)

The npm package @years17/n8n-nodes-utils-helper was published with embedded malicious code designed to perform host reconnaissance and secret exfiltration. The package's postinstall script (also triggered on require() via index.js) executes a series of reconnaissance commands including id, hostname, uname -a, docker socket checks, sudo -l, docker ps, directory listings, and SSH key enumeration. The collected output is base64-encoded and transmitted to https://jasabersama.id/portfolio-data.php with TLS certificate validation disabled.\n\nBeyond the automatic postinstall behavior, the package includes a bundled n8n node called PwnNode that exposes an execute() method. This method runs additional host reconnaissance commands (id, hostname, uname -a, and filesystem listings) via child_process.execSync and returns the results as a JSON object with a pwned flag, providing an operator-triggered reconnaissance capability within n8n workflows.\n\nThe package advertises itself as a utility helper for n8n but contains no legitimate functionality—its sole purpose is host reconnaissance, secret harvesting, and data exfiltration. The attack was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.\n\nAny system that installed this package or required it as a dependency was compromised, with sensitive environment variables, SSH keys, and system information exfiltrated to the attacker's server.