The malicious npm package @years20/n8n-nodes-utils-helper-c (version 1.0.0) executes code during its postinstall script that runs system commands ('id' and 'hostname'), reads the SSH host public key, detects Windows Subsystem for Linux (WSL), and encodes this information in base64. It sends the data via an HTTPS GET request to jasabersama.id with TLS verification disabled, framing the payload as a shell command for remote execution. Additionally, it decodes and writes an embedded OpenSSH ed25519 private key to a temporary file with restrictive permissions, then attempts SSH connections to localhost on ports 22495 and 22 using multiple usernames. Successful connections execute system commands, enabling authenticated lateral movement and remote code execution on the installer host. The package falsely identifies as an n8n helper utility, indicating a targeted campaign against n8n users.

This malicious package compromises the security of the host system by exfiltrating sensitive system information and SSH keys, disabling TLS verification to facilitate data theft. It enables attackers to gain authenticated SSH access to the local machine using an attacker-controlled private key, allowing remote code execution and lateral movement. This can lead to full system compromise of the host where the package is installed.

No official patch or remediation is currently available. Users should immediately uninstall the @years20/n8n-nodes-utils-helper-c package version 1.0.0 if installed. Avoid using this package and verify the integrity and source of npm packages before installation. Monitor for any unauthorized SSH keys or suspicious SSH activity on affected systems. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.