Malicious code in @years20/n8n-nodes-utils-helper-b (npm)

The npm package @years20/n8n-nodes-utils-helper-b was published with embedded malicious code designed to harvest sensitive data and establish unauthorized access on affected systems.\n\nUpon installation and import, the package executes reconnaissance and exfiltration routines. It collects system information (user ID, hostname, WSL detection status) and reads the SSH public key from /etc/ssh/ssh_host_ed25519_key.pub. This data is base64-encoded and exfiltrated via HTTP GET request to https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c= with TLS verification disabled.\n\nThe malicious code additionally writes an embedded OpenSSH ed25519 private key to /tmp/pk with restricted permissions (600) and attempts authenticated SSH connections to 127.0.0.1 and localhost on ports 22495 and 22, using a hardcoded user list (devuser, ubuntu, runner, node, root, chris, user). This behavior suggests targeting of developer and CI/CD environments for lateral movement or persistence.\n\nThe payload is duplicated across both the postinstall hook and the main entry point (callback.js and index.js), ensuring execution even when npm install is run with --ignore-scripts, since the package is loaded at runtime by n8n.