OpenSSF/OSV advisory MAL-2026-13916 confirms this npm version as malicious. On `npm install`, the package's postinstall script (duplicated in the main module) executes shell commands to collect host identity (`id`, `hostname`, `pwd`), locates n8n installation directories, enumerates running n8n processes, and reads n8n-related environment variables. The collected output is base64-encoded and sent via HTTPS GET to the hardcoded endpoint `https://jasabersama.id/portfolio-data.php` with TLS...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years20/n8n-nodes-utils-helper-g (npm)
Details
On `npm install`, the package's postinstall script (duplicated in the main module) executes shell commands to collect host identity (`id`, `hostname`, `pwd`), locates n8n installation directories, enumerates running n8n processes, and reads n8n-related environment variables. The collected output is base64-encoded and sent via HTTPS GET to the hardcoded endpoint `https://jasabersama.id/portfolio-data.php` with TLS certificate validation disabled (`rejectUnauthorized: false`). The request includes a static key parameter `k=S7k9xQ2mZj` and a `c=` parameter containing a shell command payload (`echo <base64> | base64 -d >> /tmp/n8n_rce_result.txt`), and the endpoint filename plus payload shape indicate an RCE staging harness. The package's advertised utility helper purpose is a cover; the only substantive content is the install-time recon and beacon.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years20/n8n-nodes-utils-helper-g@1.0.0 as malicious (MAL-2026-13916): Malicious code in @years20/n8n-nodes-utils-helper-g (npm)