If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (3bd60aaab1ca86f97939ddbea892feba63b7d911dd038a8d6f348ece5af3a76e)
The package advertises itself as an n8n utility helper and registers a trivial stub node (nodes/PwnNode.node.js), but its postinstall lifecycle script performs the actual behavior. On install it fetches a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz with TLS verification disabled (rejectUnauthorized:false), extracts it into the user's Python site-packages directory, and invokes attack tooling from the dropped archive (PyRoxy, impacket, mhddos /tmp/mhddos/start.py). The same postinstall executes `id` and `hostname` on the installer's machine, base64-encodes the output together with results from the dropped payload, and sends them to https://jasabersama.id/portfolio-data.php via an https.get whose path smuggles a base64-piped shell command. Installing the package results in attacker-controlled code being written to the Python import path and executed on the installer's host, and installer identity/execution results being transmitted to the author-controlled endpoint.