The @years20/n8n-nodes-utils-helper-d npm package version 1.0.0 includes a hostile payload executed via its postinstall hook and the main module file. The payload collects system identifiers and SSH public keys, base64-encodes them, and sends them over HTTPS to jasabersama.id with TLS verification disabled. It also writes a base64-decoded OpenSSH ed25519 private key to /tmp/pk, sets restrictive permissions, and attempts SSH logins to localhost on ports 22495 and 22 using multiple usernames. Successful logins are reported back to the attacker-controlled server. Because the payload is duplicated in the main module, requiring the package triggers the malicious code, bypassing common script execution mitigations.

This malicious package can lead to unauthorized data exfiltration of sensitive system information and SSH keys. The attacker may gain unauthorized SSH access to the affected system using the embedded private key and attempted logins, potentially allowing full system compromise. The disabling of TLS verification increases the risk of interception or manipulation of exfiltrated data. The infection occurs both at install time and at runtime when the package is imported, increasing the attack surface.

No official patch or remediation is currently available. Users should immediately remove the @years20/n8n-nodes-utils-helper-d package version 1.0.0 from their environments and avoid using this package. Audit systems for signs of compromise, especially for unauthorized SSH access or unexpected network connections to jasabersama.id. Use trusted sources for npm packages and consider implementing additional supply chain security measures such as package integrity verification and dependency auditing.