MAL-2026-13870

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (14f2f873930574335cddd8ac2a79b3c811b317f636d08c8dd218dae63a8ce8d2) The package's postinstall script (also executed on require() via index.js) runs a series of host reconnaissance commands (id, hostname, uname -a, docker socket check, sudo -l, docker ps, listings of /home/ubuntu and /root, contents of ~ubuntu/.ssh/authorized_keys, and env vars filtered by docker|n8n|secret|token|key|pass), base64-encodes the output, and transmits it as a query parameter to https://jasabersama.id/portfolio-data.php with TLS certificate validation disabled (rejectUnauthorized: false). Additionally, a bundled n8n node (PwnNode) exposes an execute() method that runs `id; hostname; uname -a; ls -la /home; ls -la /` via child_process.execSync and returns the output as `{ pwned: true, result:... }`, providing an operator-triggered host reconnaissance primitive inside any n8n workflow that uses the node. The package advertises itself as a utility helper but its only functionality is host reconnaissance, secret harvesting, and exfiltration.