The @years17/n8n-nodes-utils-helper-e package version 1.0.0 includes a postinstall hook that auto-executes a script appending a hardcoded attacker SSH Ed25519 public key labeled 'pwn@kali' to /home/ubuntu/.ssh/authorized_keys, creating a persistent SSH backdoor. The script collects system information using commands such as id, sudo -n id, docker ps, and hostname, base64-encodes the output, and sends it via an HTTP GET request to https://jasabersama.id/portfolio-data.php with TLS certificate validation disabled. The package also registers an n8n node class whose execute() method runs system commands and returns their output with a 'pwned: true' marker, indicating malicious intent and active compromise.

This malicious package compromises the host by creating a persistent SSH backdoor accessible to the attacker via the hardcoded SSH public key. It enables unauthorized remote access and control. The reconnaissance commands gather sensitive system information, which is exfiltrated to an attacker-controlled server, potentially exposing system configuration and credentials. The registered node allows remote execution of system commands, further increasing the risk of full system compromise.

No official patch or remediation is currently documented for this malicious package. Users should immediately uninstall @years17/n8n-nodes-utils-helper-e version 1.0.0 if installed. Inspect and remove the attacker's SSH public key from /home/ubuntu/.ssh/authorized_keys. Conduct a thorough system audit for further compromise indicators. Avoid installing packages from untrusted sources and verify package integrity before installation.