The malicious npm package @years17/n8n-nodes-utils-helper-g (version 1.0.0) includes a postinstall hook that executes callback.js, which appends an SSH Ed25519 public key labeled 'pwn@kali' to /home/ubuntu/.ssh/authorized_keys, granting persistent unauthorized SSH access. The script collects host reconnaissance data including user ID, hostname, sudo privileges, Docker socket access, and internal DNS resolution, encodes this data in base64, and sends it over HTTPS to jasabersama.id/portfolio-data.php with certificate verification disabled (rejectUnauthorized:false). The exfiltration URL includes a parameter that appears to allow remote command execution on the victim host. Furthermore, the package exposes an n8n node (PwnNode.node.js) whose execute() method runs system commands (id, hostname, uname, directory listings) via child_process.execSync and returns the output as JSON, enabling attackers to execute arbitrary commands within n8n workflows.

This malicious package compromises the installer's host by granting persistent remote SSH access through an attacker-controlled public key. It enables extensive host reconnaissance and data exfiltration to a remote command and control server. The exposed n8n node allows execution of arbitrary system commands, facilitating further post-exploitation activities. This can lead to full system compromise, unauthorized data access, and lateral movement within affected environments.

No official patch or remediation is currently documented for this malicious package. Users should immediately uninstall @years17/n8n-nodes-utils-helper-g version 1.0.0 if installed. Inspect and remove any unauthorized SSH keys from /home/ubuntu/.ssh/authorized_keys. Investigate for signs of compromise, including unusual network traffic to jasabersama.id and presence of the PwnNode node in n8n workflows. Avoid installing packages from untrusted sources and verify package integrity before use.