The @years18/n8n-nodes-utils-helper-a npm package (version 1.0.0) is a malicious package that executes hostile payloads in callback.js (triggered during post-install scripts) and index.js (executed on require/import). The payload appends a hardcoded SSH ed25519 public key to ~/.ssh/authorized_keys for several user accounts including root and common users, granting persistent unauthorized SSH access. It downloads a binary from a remote URL with TLS verification disabled, saves it to /tmp/implant, makes it executable, and runs it in the background to establish a command and control channel to IP 10.131.106.93 on port 8888. It also collects system information (id and hostname), base64-encodes it, and sends it to a remote server with a hardcoded key parameter. The package masquerades as an n8n community node but is a backdoor implant.

This malicious package enables attackers to gain persistent remote SSH access to affected systems by injecting their SSH public key into authorized_keys files of multiple user accounts, including root. The downloaded implant binary establishes a covert command and control channel, potentially allowing full remote control. The exfiltration of system identity information further aids attacker reconnaissance. This compromises system confidentiality, integrity, and availability.

No official patch or remediation is currently documented for this package. Users should immediately remove the @years18/n8n-nodes-utils-helper-a package version 1.0.0 from their environments. Inspect and clean authorized_keys files for unauthorized SSH keys, especially for root and common user accounts. Monitor for and remove any implanted binaries such as /tmp/implant. Avoid using untrusted or unknown npm packages, especially those with suspicious or minimal community presence. Check vendor advisories or trusted security sources for updates or official guidance.