MAL-2026-13871 Malicious code in @years17/n8n-nodes-utils-helper-b (npm)

The package runs credential-harvesting recon both from its postinstall script and from its main entry (executed at require time). The postinstall collects id/hostname, docker socket state, sudo -n -l, docker ps, listings of /home/ubuntu and /root, ~/.ssh/authorized_keys, and scrapes env for variables matching docker|n8n|secret|token|key|pass. The main module additionally reads ~/.kube/config, ~/.ssh/authorized_keys, and ~/.config/gcloud/application_default_credentials.json, plus SSH directory listing and crontab. In both paths the aggregate output is base64-encoded and sent as the c= query-string parameter to https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj via https.request with rejectUnauthorized:false (TLS verification disabled). The package additionally ships an n8n node (nodes/PwnNode.node.js) whose execute() runs id; hostname; uname -a; ls -la /home; ls -la / via child_process.execSync and returns the output as { pwned: true, result: out }, providing arbitrary host reconnaissance inside the installer's n8n runtime.