MAL-2026-13912

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (84dc74cbe8090f7fd99c65cda379129055830b63fafb28c8364f3e28de5bbbb8) The package runs a hostile payload both from its declared postinstall hook (`node callback.js`) and at library load via `index.js`, which is byte-identical to `callback.js` and set as `main`. The payload runs `id`, collects the machine hostname, detects WSL, and reads `/etc/ssh/ssh_host_ed25519_key.pub`, then base64-encodes the data and sends it over HTTPS GET to `jasabersama.id/portfolio-data.php` with TLS verification disabled (`rejectUnauthorized: false`). The exfil query wraps the encoded data in a shell command framed as `portfolio-data.php`. The same script decodes a base64-embedded OpenSSH ed25519 private key to `/tmp/pk`, chmods it to 600, and attempts SSH logins to `127.0.0.1:22495` and `127.0.0.1:22` as users `devuser`, `ubuntu`, `runner`, `node`, `root`, `chris`, and `user`, reporting successful authentications back to `jasabersama.id`. Because the payload is duplicated at module load, it also fires when n8n or any consumer performs `require('@years20/n8n-nodes-utils-helper-d')`, bypassing `--ignore-scripts`.