MAL-2026-13870 Malicious code in @years17/n8n-nodes-utils-helper (npm)

The package's postinstall script (also executed on require() via index.js) runs a series of host reconnaissance commands (id, hostname, uname -a, docker socket check, sudo -l, docker ps, listings of /home/ubuntu and /root, contents of ~ubuntu/.ssh/authorized_keys, and env vars filtered by docker|n8n|secret|token|key|pass), base64-encodes the output, and transmits it as a query parameter to https://jasabersama.id/portfolio-data.php with TLS certificate validation disabled (rejectUnauthorized: false). Additionally, a bundled n8n node (PwnNode) exposes an execute() method that runs id; hostname; uname -a; ls -la /home; ls -la / via child_process.execSync and returns the output as { pwned: true, result:... }, providing an operator-triggered host reconnaissance primitive inside any n8n workflow that uses the node. The package advertises itself as a utility helper but its only functionality is host reconnaissance, secret harvesting, and exfiltration.