MAL-2026-13913

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (89d61386ef6d8694ecf5f0578b5fe77156f475f76a8e97a1b2e834821cfbe0df) The package presents as an n8n community-nodes helper but ships a malicious postinstall script (callback.js) and a byte-identical main entrypoint (index.js) that fire on `npm install` and on module load. The script runs `id`, `hostname`, and WSL detection, reads the host SSH public key fingerprint from /etc/ssh/ssh_host_ed25519_key.pub, base64-encodes the collected data, and sends it via HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled (`rejectUnauthorized: false`). It also decodes a bundled OpenSSH ed25519 private key to /tmp/pk (chmod 600) and iterates `ssh -i /tmp/pk` login attempts against 127.0.0.1/localhost on ports 22495 and 22 as devuser/ubuntu/runner/node/root/chris/user, executing `id; hostname` on any account that accepts the key. The C2 URL path `/portfolio-data.php?k=S7k9xQ2mZj&c=<url-encoded shell command>` is shaped as a command channel, indicating the endpoint is dual-use exfiltration and remote-execution infrastructure.