OpenSSF/OSV advisory MAL-2026-13919 confirms this npm version as malicious. @years20/n8n-nodes-utils-helper-j 1.0.0 runs a postinstall script (index.js/callback.js) that executes `id` and `hostname` on the installer host, base64-encodes the output, and sends it over HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized: false). The same script writes attacker-controlled content into /tmp/n8n_rce_result.txt and /tmp/filter_pwned.txt, creates...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years20/n8n-nodes-utils-helper-j (npm)
Details
@years20/n8n-nodes-utils-helper-j 1.0.0 runs a postinstall script (index.js/callback.js) that executes `id` and `hostname` on the installer host, base64-encodes the output, and sends it over HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized: false). The same script writes attacker-controlled content into /tmp/n8n_rce_result.txt and /tmp/filter_pwned.txt, creates /tmp/src-repo, and configures a git `filter.evil.smudge` filter that shells out on checkout, staging follow-on command execution. The package presents itself as an n8n community node (nodes/PwnNode.node.js) but ships no legitimate node functionality; the recon/RCE-staging payload is the entire install-time behavior and fires automatically on `npm install`.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years20/n8n-nodes-utils-helper-j@1.0.0 as malicious (MAL-2026-13919): Malicious code in @years20/n8n-nodes-utils-helper-j (npm)