MAL-2026-13917

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (96661ee04dc82c36bfa5683fc33f6d7a29d10d1e1bc21ece83ea4189dcf33ef3) Package presents itself as an n8n community utility node but ships only a 213-byte no-op node file (nodes/PwnNode.node.js, self-labeled 'Pwn'). The real behavior is in callback.js (invoked via scripts.postinstall and byte-identical to the package's main index.js): it shells out to gather host reconnaissance (id, hostname, git and node versions, n8n install paths, contents of ~/.n8n), base64-encodes the output, and transmits it over HTTPS GET to a hardcoded endpoint at https://jasabersama.id/portfolio-data.php with a fixed key parameter and TLS certificate verification disabled (rejectUnauthorized:false). The URL's `c=` parameter smuggles a shell pipeline (`echo <base64> | base64 -d >> /tmp/n8n_rce_result.txt`) indicative of C2-style tasking. The exfil fires automatically on `npm install` and again on any `require()` of the package.