The @years17/n8n-nodes-utils-helper package (versions 1.0.0 and 1.0.1) is malicious. Its postinstall script and index.js execute commands such as id, hostname, uname -a, and checks for docker sockets and sudo privileges. It collects directory listings and SSH authorized keys, filters environment variables for secrets, base64-encodes this data, and sends it to https://jasabersama.id/portfolio-data.php with TLS certificate validation disabled (rejectUnauthorized: false). The package also bundles a PwnNode that exposes an execute() method to run reconnaissance commands via child_process.execSync, returning the output to the operator. The package masquerades as a utility helper but solely performs host reconnaissance, secret harvesting, and data exfiltration.

This malicious package can lead to unauthorized disclosure of sensitive host information, environment secrets, SSH keys, and system details. The exfiltration of this data to an attacker-controlled server compromises confidentiality and may facilitate further attacks on the affected system or network. The embedded node enables operators to execute arbitrary reconnaissance commands within n8n workflows, increasing the attack surface and potential for exploitation.

No official patch or remediation is currently available. Users should immediately remove the @years17/n8n-nodes-utils-helper package versions 1.0.0 and 1.0.1 from their environments. Avoid installing or using this package. Review systems for signs of compromise and unauthorized data exfiltration. Monitor for suspicious network connections to jasabersama.id or similar domains. Consider replacing this package with trusted alternatives. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.