Malicious code in @years20/n8n-nodes-utils-helper-j (npm)

The npm package @years20/n8n-nodes-utils-helper-j version 1.0.0 was published with malicious code embedded in its postinstall script (index.js/callback.js). Upon installation, the script automatically executed reconnaissance commands (id and hostname), base64-encoded the output, and transmitted it over HTTPS to jasabersama.id/portfolio-data.php with TLS verification disabled.\n\nBeyond reconnaissance, the malicious script wrote attacker-controlled content to temporary files (/tmp/n8n_rce_result.txt and /tmp/filter_pwned.txt), created a directory (/tmp/src-repo), and configured a git filter hook (filter.evil.smudge) designed to execute arbitrary shell commands during git checkout operations. This staged follow-on command execution capabilities on affected systems.\n\nThe package presented itself as an n8n community node (nodes/PwnNode.node.js) but shipped no legitimate node functionality. The reconnaissance and RCE-staging payload constituted the entire install-time behavior, firing automatically on npm install without user interaction.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository (MAL-2026-13919).