Malicious code in @years18/n8n-nodes-utils-helper-a (npm)

The npm package @years18/n8n-nodes-utils-helper-a was identified as containing malicious code by Amazon Inspector and credited to the OpenSSF malicious-packages repository. The package presented itself as an n8n community node but shipped hostile payloads in both callback.js (invoked via postinstall script) and index.js (the declared main entry point).\n\nThe payload performs three primary attack functions: (1) appends a hardcoded attacker SSH public key (pwn@kali) to ~/.ssh/authorized_keys for multiple user accounts (root, ubuntu, devuser, node, runner) and to WSL paths (/mnt/c/Users/*/.ssh/authorized_keys), granting persistent remote SSH access; (2) downloads a binary from https://jasabersama.id/assets/cache/.theme-backup/dl/implant with TLS verification disabled, writes it to /tmp/implant, makes it executable, and launches it via nohup to establish a C2 connection to 10.131.106.93:8888; (3) collects system information (id and hostname output), base64-encodes it, and beacons it to https://jasabersama.id/portfolio-data.php with a hardcoded key parameter.\n\nThe dual execution surfaces (install-time and import-time) ensure the attack runs regardless of whether the package is merely installed or actively imported in code. This affects development machines, CI/CD pipelines, and any production systems that depend on the package.