MAL-2026-13909 Malicious code in @years20/n8n-nodes-utils-helper-a (npm)

The package's postinstall script (callback.js) and its main module (index.js, byte-identical to callback.js) execute on both npm install and require(). They shell out to collect id, hostname, WSL indicators, and the local SSH host-key fingerprint, base64-encode the recon output, and send it to a hardcoded endpoint at https://jasabersama.id/portfolio-data.php with rejectUnauthorized: false. The payload also decodes an embedded base64 OpenSSH ed25519 private key to /tmp/pk (chmod 600) and iterates common local account names (devuser, ubuntu, runner, node, root, chris, user) attempting SSH into 127.0.0.1:22495 and 127.0.0.1:22, reporting successful logins back to the same external host. The exfil query string carries a URL-encoded shell command that the receiving PHP handler is expected to execute, indicating a server-side command channel. The trigger fires automatically at install time via scripts.postinstall and again whenever a consumer (e.g. n8n loading this custom node) imports the module.