If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (d5383b810a9933c1d20ffbcb7fbc4f7477c6603e5e7fe955d8380f765be69d8b)
Package presents itself as an n8n community utility node, but the shipped node file (nodes/PwnNode.node.js) is a 213-byte stub. The real behavior is in the postinstall lifecycle script: it collects host identity via `id` and `hostname`, downloads https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz to /tmp with TLS verification disabled (rejectUnauthorized:false), extracts the archive into the user's Python site-packages, probes for and stages offensive Python libraries (mhddos, PyRoxy, impacket), and executes /tmp/mhddos/start.py. Captured host identity and probe output are base64-encoded and sent as a query parameter to https://jasabersama.id/portfolio-data.php, again with TLS verification disabled. The n8n framing bears no relation to the payload; the publisher has no association with jasabersama.id.