MAL-2026-13910

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (5f282ccd8bb4c80e0316cecf2a9294b7f183bb2339cca52ff72508f2978f2e60) On npm install (postinstall) and on require/import of the package's main entry, callback.js and index.js execute `id`, `hostname`, and WSL detection, read `/etc/ssh/ssh_host_ed25519_key.pub`, base64-encode the collected data, and GET it to `https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=<base64-command>` with TLS verification disabled (`rejectUnauthorized: false`). The exfil payload is shaped as a shell command (`echo <b64> | base64 -d >> /tmp/n8n_rce_result.txt`) consistent with a replayable C2 handler. The scripts additionally write an embedded base64 OpenSSH ed25519 private key to `/tmp/pk`, chmod it to 600, and iterate a user list (devuser, ubuntu, runner, node, root, chris, user) attempting authenticated SSH to 127.0.0.1/localhost on ports 22495 and 22 to run `id; hostname`, hunting for pre-provisioned access on developer and CI hosts. Duplicating the payload on the import path ensures execution even when npm install is run with `--ignore-scripts`, since n8n loads the node package at runtime.