MAL-2026-13919

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (ae821bd0afd5bdf483830eddac1c875d1ec3d229ca2078aa4fe7d88e9573eefb) @years20/n8n-nodes-utils-helper-j 1.0.0 runs a postinstall script (index.js/callback.js) that executes `id` and `hostname` on the installer host, base64-encodes the output, and sends it over HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized: false). The same script writes attacker-controlled content into /tmp/n8n_rce_result.txt and /tmp/filter_pwned.txt, creates /tmp/src-repo, and configures a git `filter.evil.smudge` filter that shells out on checkout, staging follow-on command execution. The package presents itself as an n8n community node (nodes/PwnNode.node.js) but ships no legitimate node functionality; the recon/RCE-staging payload is the entire install-time behavior and fires automatically on `npm install`.