The malicious npm package @years17/n8n-nodes-utils-helper-b version 1.0.0 executes credential-harvesting activities both during its postinstall script and when required as a module. It collects a wide range of sensitive host data, including system IDs, Docker information, sudo privileges, SSH keys, environment variables containing secrets, Kubernetes and Google Cloud credentials, and crontab entries. This information is base64-encoded and sent via an unverified HTTPS request to a remote endpoint. Furthermore, the package provides an n8n node that runs system commands to perform host reconnaissance and returns the output, enabling attackers to gather detailed system information within the n8n workflow environment.

The package compromises host confidentiality by exfiltrating sensitive credentials and system information to an attacker-controlled server. This can lead to unauthorized access, privilege escalation, and further compromise of the affected system and connected infrastructure. The presence of arbitrary command execution within the n8n node increases the risk of remote code execution and system control by an attacker.

No official patch or remediation is currently documented. Users should immediately remove the @years17/n8n-nodes-utils-helper-b package version 1.0.0 from their environments. Avoid installing or requiring this package. Conduct a thorough security review of affected systems for signs of compromise and credential theft. Monitor network traffic for connections to the indicated malicious domain. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.