The @years17/n8n-nodes-utils-helper-c package (version 1.0.0) includes a postinstall script that executes shell commands to gather sensitive host information such as user identity, hostname, environment variables, containerization status, and directory listings. This information is base64-encoded and transmitted as a URL query parameter to a remote endpoint (https://jasabersama.id/portfolio-data.php) with TLS verification disabled, indicating potential interception risk. The package also contains an n8n node (HelperUtils) that runs shell reconnaissance commands during workflow execution and returns raw command output, exposing host details. The package name and description do not reveal these malicious behaviors, suggesting intent to deceive users.

The malicious package can leak sensitive host environment information to an attacker-controlled server, potentially exposing user identities, system configurations, containerization status, and directory contents. The disabled TLS verification increases the risk of interception or man-in-the-middle attacks during data exfiltration. The execution of shell commands within workflows can lead to unauthorized information disclosure and may facilitate further compromise depending on the environment.

No official patch or remediation is currently documented for this package. Users should avoid installing or using @years17/n8n-nodes-utils-helper-c version 1.0.0. Remove the package from any environments where it is installed. Monitor for unexpected network connections to the indicated remote server and audit workflows for suspicious execution of shell commands. Check vendor or repository advisories for updates or removal notices. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.