OpenSSF/OSV advisory MAL-2026-13913 confirms this npm version as malicious. The package presents as an n8n community-nodes helper but ships a malicious postinstall script (callback.js) and a byte-identical main entrypoint (index.js) that fire on `npm install` and on module load. The script runs `id`, `hostname`, and WSL detection, reads the host SSH public key fingerprint from /etc/ssh/ssh_host_ed25519_key.pub, base64-encodes the collected data, and sends it via HTTPS GET to...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years20/n8n-nodes-utils-helper-e (npm)
Details
The package presents as an n8n community-nodes helper but ships a malicious postinstall script (callback.js) and a byte-identical main entrypoint (index.js) that fire on `npm install` and on module load. The script runs `id`, `hostname`, and WSL detection, reads the host SSH public key fingerprint from /etc/ssh/ssh_host_ed25519_key.pub, base64-encodes the collected data, and sends it via HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled (`rejectUnauthorized: false`). It also decodes a bundled OpenSSH ed25519 private key to /tmp/pk (chmod 600) and iterates `ssh -i /tmp/pk` login attempts against 127.0.0.1/localhost on ports 22495 and 22 as devuser/ubuntu/runner/node/root/chris/user, executing `id; hostname` on any account that accepts the key. The C2 URL path `/portfolio-data.php?k=S7k9xQ2mZj&c=<url-encoded shell command>` is shaped as a command channel, indicating the endpoint is dual-use exfiltration and remote-execution infrastructure.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years20/n8n-nodes-utils-helper-e@1.0.0 as malicious (MAL-2026-13913): Malicious code in @years20/n8n-nodes-utils-helper-e (npm)