The malicious npm package @years20/n8n-nodes-utils-helper-a (version 1.0.0) includes a postinstall script and main module that execute automatically on installation and import. These scripts gather system information such as user ID, hostname, WSL indicators, and SSH host key fingerprints, encoding and exfiltrating this data to a hardcoded URL (https://jasabersama.id/portfolio-data.php) with disabled TLS verification. The payload also writes a base64-decoded OpenSSH ed25519 private key to /tmp/pk with restricted permissions and attempts SSH logins to localhost on ports 22495 and 22 using common usernames. Successful logins are reported back to the attacker. The exfiltration endpoint accepts URL-encoded shell commands, indicating a remote command execution channel controlled by the attacker. This behavior occurs both at npm install time and when the module is required by consuming software such as n8n.

This malicious package compromises system confidentiality and integrity by exfiltrating sensitive system information and SSH credentials to an attacker-controlled server. It enables unauthorized SSH access to the local machine and establishes a remote command execution channel, potentially allowing full system compromise. The automatic execution on install and import increases the risk of unnoticed infection in environments using this package.

No official patch or remediation is currently documented for this package. Users should immediately remove version 1.0.0 of @years20/n8n-nodes-utils-helper-a from their environments. Avoid installing or importing this package. Monitor for any unauthorized SSH activity or connections to the indicated external domain. Since this is a malicious package, the best mitigation is to avoid use and remove any existing installations. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.