The npm package @years20/n8n-nodes-utils-helper-e (version 1.0.0) is a malicious package masquerading as an n8n community nodes helper. It contains a postinstall script and a main entrypoint script that execute automatically on npm install and module load. These scripts gather system information (user ID, hostname, WSL detection) and read the SSH public key fingerprint from the host. The collected data is base64-encoded and sent via an HTTPS GET request to jasabersama.id/portfolio-data.php with TLS verification disabled, exposing the data to interception. The package also decodes and writes a bundled OpenSSH ed25519 private key to /tmp/pk with restricted permissions, then attempts SSH logins to localhost on ports 22495 and 22 using this key and a list of common usernames. Upon successful login, it executes commands to gather further system information. The remote server endpoint supports command injection via URL parameters, indicating it functions as a dual-purpose exfiltration and remote execution infrastructure.

This malicious package compromises the host system by exfiltrating sensitive system and SSH key information to an attacker-controlled server. It enables unauthorized local SSH access using a private key embedded in the package, potentially allowing the attacker to execute arbitrary commands on the compromised system. The disabled TLS verification during data exfiltration increases the risk of interception or manipulation of the communication. Overall, this leads to a severe compromise of confidentiality, integrity, and potentially availability of the affected system.

No official patch or remediation is currently available for this malicious package. Users should immediately uninstall the package @years20/n8n-nodes-utils-helper-e version 1.0.0 if installed. Avoid installing packages from untrusted or unknown sources. Review system logs and SSH access for signs of compromise, especially local SSH login attempts on ports 22 and 22495. Rotate SSH keys and credentials if this package was installed. Monitor network traffic for connections to jasabersama.id or similar suspicious domains. Consider restoring affected systems from known good backups if compromise is suspected.