MAL-2026-13876 Malicious code in @years17/n8n-nodes-utils-helper-g (npm)

The package's postinstall hook runs callback.js, which appends an attacker-controlled ssh-ed25519 public key (labeled pwn@kali) to /home/ubuntu/.ssh/authorized_keys, granting persistent remote SSH access to the installer's host. The same script collects host reconnaissance (id, hostname, sudo -n -l, ls -la /var/run/docker.sock, docker ps, /etc/hosts, internal name resolution for nexus.local), base64-encodes the output, and sends it over HTTPS to jasabersama.id/portfolio-data.php with certificate verification disabled (rejectUnauthorized:false). The exfil URL also carries a c= parameter whose value is a shell command (echo <b64> | base64 -d >> /tmp/n8n_rce_result.txt), consistent with a server-side command handler at the C2 endpoint. In addition, nodes/PwnNode.node.js exposes an n8n node whose execute() runs id; hostname; uname -a; ls -la /home; ls -la / via child_process.execSync and returns the output as node JSON (pwned:true), providing a post-exploitation primitive to any workflow that uses the node.