The package @years17/n8n-nodes-utils-helper-i version 1.0.0 includes a postinstall hook that executes callback.js, which appends a hardcoded SSH Ed25519 public key labeled 'pwn@kali' to the authorized_keys files of root, ubuntu, node, runner, and devuser accounts, enabling persistent unauthorized SSH access. It collects host information including user IDs, hostname, sudo privileges, home directory contents, and docker.sock presence, encodes this data in base64, and sends it via an HTTPS GET request to jasabersama.id/portfolio-data.php with TLS verification disabled. The main entry file index.js contains identical malicious code, triggering the implant and data exfiltration upon requiring the package, even if installation scripts are ignored. This dual trigger mechanism increases the likelihood of compromise on systems using this package.

Successful installation or use of this package results in persistent unauthorized SSH access for the attacker to the affected host, enabling potential full control. Additionally, sensitive host information is exfiltrated to a remote server, potentially aiding further attacks or reconnaissance. The presence of the malicious code in both install and runtime phases increases the risk of compromise even if installation scripts are disabled.

No official patch or remediation is currently documented. Users should immediately remove the package @years17/n8n-nodes-utils-helper-i version 1.0.0 from their environments. Investigate and remove the attacker's SSH public key from authorized_keys files of affected users. Review system logs and network traffic for signs of compromise and unauthorized access. Avoid using this package until a trusted, clean version is available. Monitor vendor advisories for updates or official fixes.