Malicious code in @years20/n8n-nodes-utils-helper-g (npm)

The npm package @years20/n8n-nodes-utils-helper-g was published with malicious code embedded in its postinstall script. Upon installation, the script executes shell commands to collect system identity information including the output of id, hostname, and pwd, and enumerates n8n installation directories and running processes.\n\nThe collected reconnaissance data is base64-encoded and exfiltrated via HTTPS GET requests to the hardcoded endpoint https://jasabersama.id/portfolio-data.php with TLS certificate validation disabled. The requests include a static key parameter k=S7k9xQ2mZj and a command payload parameter c= containing shell commands, indicating an RCE staging harness.\n\nThe package's advertised purpose as a utility helper is a cover for its true malicious functionality. The only substantive content is the install-time reconnaissance and command-and-control beacon targeting n8n environments.\n\nThe incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project (MAL-2026-13916).