The npm package @years20/n8n-nodes-utils-helper-f version 1.0.0 auto-executes a reconnaissance and exfiltration payload via post-install scripts and top-level require code. The payload gathers host identity data including system ID, hostname, network interfaces, and WSL detection status, reads the SSH host public key from /etc/ssh/ssh_host_ed25519_key.pub, and probes internal network ports such as 10.131.106.231:22495. The collected data is base64-encoded and transmitted over HTTPS to https://jasabersama.id/portfolio-data.php with TLS certificate verification disabled (rejectUnauthorized:false). The package falsely presents itself as an n8n helper node but contains no actual n8n functionality, indicating it is a malicious package designed for reconnaissance and data theft.

This malicious package compromises host confidentiality by collecting sensitive system information and SSH public keys, and exfiltrates this data to an attacker-controlled server. The disabled TLS verification increases the risk of man-in-the-middle interception or manipulation of the exfiltration traffic. The internal network port scanning may reveal additional network topology or services to the attacker. The presence of this package in a project can lead to unauthorized data disclosure and potential further compromise of the affected environment.

No official patch or remediation is available for this package version. Users should immediately remove @years20/n8n-nodes-utils-helper-f version 1.0.0 from their projects and dependency trees. Avoid installing or requiring this package. Review systems for signs of data exfiltration and unauthorized network scanning. Use trusted sources and verify package integrity before installation. Monitor for any updates from the package maintainer or npm advisories regarding this package.