The package's postinstall script runs automatically on npm install and performs three malicious actions: (1) executes reconnaissance commands (id, sudo -n id, docker.sock check, /etc/hosts, hostname) and base64-exfiltrates the output over HTTPS to https://jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized:false); (2) appends a hardcoded attacker ssh-ed25519 public key (comment 'pwn@kali') to /home/ubuntu/.ssh/authorized_keys, granting persistent SSH access to the installer host; (3) the exfiltration URL includes a 'c=' parameter that acts as a server-side command channel, indicating the endpoint functions as a command and control server. Additionally, the package ships an n8n node named 'PwnNode' that executes system commands (id; hostname; uname -a; ls -la /home; ls -la /) via child_process.execSync during workflow runs and returns a result indicating compromise.

Successful installation and use of this package results in unauthorized data exfiltration, persistent remote access via SSH for the attacker, and execution of arbitrary system commands on the host. This compromises the confidentiality, integrity, and availability of the affected system.

No official patch or remediation is currently available. Users should immediately remove the package @years17/n8n-nodes-utils-helper-f version 1.0.0 from their environments and avoid installing it. Review systems for unauthorized SSH keys and suspicious network activity related to the exfiltration domain. Monitor for signs of compromise and consider rotating credentials and access keys. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.