OpenSSF/OSV advisory MAL-2026-13917 confirms this npm version as malicious. Package presents itself as an n8n community utility node but ships only a 213-byte no-op node file (nodes/PwnNode.node.js, self-labeled 'Pwn'). The real behavior is in callback.js (invoked via scripts.postinstall and byte-identical to the package's main index.js): it shells out to gather host reconnaissance (id, hostname, git and node versions, n8n install paths, contents of ~/.n8n), base64-encodes the output, and...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years20/n8n-nodes-utils-helper-h (npm)
Details
Package presents itself as an n8n community utility node but ships only a 213-byte no-op node file (nodes/PwnNode.node.js, self-labeled 'Pwn'). The real behavior is in callback.js (invoked via scripts.postinstall and byte-identical to the package's main index.js): it shells out to gather host reconnaissance (id, hostname, git and node versions, n8n install paths, contents of ~/.n8n), base64-encodes the output, and transmits it over HTTPS GET to a hardcoded endpoint at https://jasabersama.id/portfolio-data.php with a fixed key parameter and TLS certificate verification disabled (rejectUnauthorized:false). The URL's `c=` parameter smuggles a shell pipeline (`echo <base64> | base64 -d >> /tmp/n8n_rce_result.txt`) indicative of C2-style tasking. The exfil fires automatically on `npm install` and again on any `require()` of the package.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years20/n8n-nodes-utils-helper-h@1.0.0 as malicious (MAL-2026-13917): Malicious code in @years20/n8n-nodes-utils-helper-h (npm)