MAL-2026-13913 Malicious code in @years20/n8n-nodes-utils-helper-e (npm)

The package presents as an n8n community-nodes helper but ships a malicious postinstall script (callback.js) and a byte-identical main entrypoint (index.js) that fire on npm install and on module load. The script runs id, hostname, and WSL detection, reads the host SSH public key fingerprint from /etc/ssh/ssh_host_ed25519_key.pub, base64-encodes the collected data, and sends it via HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized: false). It also decodes a bundled OpenSSH ed25519 private key to /tmp/pk (chmod 600) and iterates ssh -i /tmp/pk login attempts against 127.0.0.1/localhost on ports 22495 and 22 as devuser/ubuntu/runner/node/root/chris/user, executing id; hostname on any account that accepts the key. The C2 URL path /portfolio-data.php?k=S7k9xQ2mZj&c=<url-encoded shell command> is shaped as a command channel, indicating the endpoint is dual-use exfiltration and remote-execution infrastructure.