If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (39f5f361848c187cd60f9143d0bdc5d2db20a3e2fa03fe5e494697da05c4a42a)
The package advertises itself as an n8n community utility helper node (package.json declares n8n.nodes: ["nodes/PwnNode.node.js"] with description 'Utility helper nodes for workflow automation'), but its callback.js (invoked from the declared postinstall hook `node callback.js`) and its main entry index.js contain identical top-level code that: (1) writes a Python script to /tmp/attack2.py and launches it via `nohup python3 /tmp/attack2.py... &`, which floods 103.118.252.21 on ports 80/443 with UDP/TCP traffic using 2000 threads for 900 seconds; and (2) collects host identity (uid, hostname, process/load information), base64-encodes it, and sends it over HTTPS GET to jasabersama.id/portfolio-data.php with TLS certificate verification disabled (rejectUnauthorized:false). Because the dropper is both in the postinstall script and at the top level of the main module, it executes on `npm install` and again every time a consumer `require`s the package or n8n loads the node.