OpenSSF/OSV advisory MAL-2026-13871 confirms this npm version as malicious. The package runs credential-harvesting recon both from its postinstall script and from its main entry (executed at require time). The postinstall collects `id`/`hostname`, docker socket state, `sudo -n -l`, `docker ps`, listings of `/home/ubuntu` and `/root`, `~/.ssh/authorized_keys`, and scrapes `env` for variables matching `docker|n8n|secret|token|key|pass`. The main module additionally reads `~/.kube/config`,...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years17/n8n-nodes-utils-helper-b (npm)
Details
The package runs credential-harvesting recon both from its postinstall script and from its main entry (executed at require time). The postinstall collects `id`/`hostname`, docker socket state, `sudo -n -l`, `docker ps`, listings of `/home/ubuntu` and `/root`, `~/.ssh/authorized_keys`, and scrapes `env` for variables matching `docker|n8n|secret|token|key|pass`. The main module additionally reads `~/.kube/config`, `~/.ssh/authorized_keys`, and `~/.config/gcloud/application_default_credentials.json`, plus SSH directory listing and crontab. In both paths the aggregate output is base64-encoded and sent as the `c=` query-string parameter to `https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj` via `https.request` with `rejectUnauthorized:false` (TLS verification disabled). The package additionally ships an n8n node (`nodes/PwnNode.node.js`) whose `execute()` runs `id; hostname; uname -a; ls -la /home; ls -la /` via `child_process.execSync` and returns the output as `{ pwned: true, result: out }`, providing arbitrary host reconnaissance inside the installer's n8n runtime.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years17/n8n-nodes-utils-helper-b@1.0.0 as malicious (MAL-2026-13871): Malicious code in @years17/n8n-nodes-utils-helper-b (npm)