Malicious code in @years20/n8n-nodes-utils-helper-d (npm)

The npm package @years20/n8n-nodes-utils-helper-d was published with embedded malicious code designed to exfiltrate sensitive system information and credentials. The payload executes through two mechanisms: a postinstall hook (node callback.js) and at library load via index.js, which is set as the package's main entry point.\n\nThe malicious code collects the output of the id command, the machine hostname, detects whether the system is running Windows Subsystem for Linux (WSL), and reads the SSH public key from /etc/ssh/ssh_host_ed25519_key.pub. This data is base64-encoded and exfiltrated via HTTPS GET requests to jasabersama.id/portfolio-data.php with TLS verification disabled. The payload also decodes an embedded OpenSSH ed25519 private key, writes it to /tmp/pk, and attempts SSH logins to 127.0.0.1:22495 and 127.0.0.1:22 using multiple common usernames (devuser, ubuntu, runner, node, root, chris, user), reporting successful authentications back to the attacker's server.\n\nBecause the malicious code is duplicated at module load time rather than only in the postinstall hook, it executes whenever any application (including n8n) performs require('@years20/n8n-nodes-utils-helper-d'), effectively bypassing npm's --ignore-scripts flag. This makes the package dangerous even for users who attempt to mitigate postinstall hook risks.