Malicious code in @years20/n8n-nodes-utils-helper-i (npm)

The npm package @years20/n8n-nodes-utils-helper-i was published with malicious code disguised as an n8n helper node utility. The package contained only a stub node file (nodes/PwnNode.node.js) and a postinstall script (callback.js, duplicated as index.js) that executed on npm install.\n\nThe postinstall script performed installer-side reconnaissance by collecting sensitive system information including user ID, hostname, git configuration, running n8n processes, and locations of .n8n directories. This data was base64-encoded and exfiltrated via HTTPS GET requests to https://jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized: false).\n\nAdditionally, the postinstall script performed an unpinned git clone of a personal GitHub repository (github.com/yadhukrishnam/CVE-2026-25053) into /tmp/gh-test during installation. The repository name embeds a CVE identifier consistent with an n8n supply-chain proof-of-concept payload, indicating the package was designed as a targeted attack vector.\n\nThe incident was identified and reported by the OpenSSF malicious-packages project via Amazon Inspector.", <parameter name="remediation">["Immediately uninstall @years20/n8n-nodes-utils-helper-i from all systems", "Audit npm install logs to identify when the package was installed", "Review system logs for suspicious outbound HTTPS connections to jasabersama.id", "Inspect /tmp/gh-test for any cloned repository content and remove if present", "Rotate any credentials or sensitive data that may have been exposed during the reconnaissance phase", "Review git configuration for any unauthorized changes", "Monitor for any n8n process anomalies or unauthorized modifications", "Use npm audit to check for other malicious packages in your dependency tree"]