Malicious code in @years20/n8n-nodes-utils-helper-a (npm)

The npm package @years20/n8n-nodes-utils-helper-a was published with embedded malicious code designed to execute automatically during installation and module import. The attack chain included two entry points: a postinstall script (callback.js) and the main module (index.js), both byte-identical and triggering on npm install and require().

The malicious payload performed system reconnaissance by collecting the output of id, hostname, WSL indicators, and SSH host-key fingerprints. This information was base64-encoded and exfiltrated to a hardcoded endpoint at https://jasabersama.id/portfolio-data.php with SSL certificate validation disabled.

The package also embedded a base64-encoded OpenSSH ed25519 private key, which was decoded and written to /tmp/pk with restricted permissions (chmod 600). The malware then attempted SSH brute-force access to localhost on ports 22495 and 22 using common account names (devuser, ubuntu, runner, node, root, chris, user), reporting successful logins back to the external command server.

The exfiltration payload included a URL-encoded shell command parameter, indicating the receiving PHP handler was designed to execute arbitrary commands server-side, establishing a persistent remote command channel.