The package @years19/n8n-nodes-utils-helper-f (version 1.0.0) includes a postinstall script that gathers system identity and environment fingerprint data, including user and hostname information and the presence of certain offensive tooling. This data is base64-encoded and sent via an HTTP request with disabled TLS verification to https://jasabersama.id/portfolio-data.php, including a hardcoded key and a command injection pattern that writes decoded data to a temporary file. Both installation and requiring the package trigger this behavior. The package name mimics legitimate n8n community nodes, but the main module contains the same malicious code as the postinstall script, indicating intent to stealthily exfiltrate data and maintain a command channel.

The malicious package exfiltrates sensitive host and environment information to an attacker-controlled server without user consent, potentially exposing system details that could aid further attacks. The disabled TLS verification increases the risk of interception or manipulation of the exfiltrated data. The package's behavior could facilitate persistent attacker presence or command execution on affected systems.

No official patch or remediation is currently available. Users should immediately remove the package @years19/n8n-nodes-utils-helper-f version 1.0.0 from their environments and avoid installing or requiring it. Verify dependencies to ensure this malicious package is not included transitively. Monitor for any signs of compromise related to this package and consider network controls to block communication to the indicated attacker domain. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.