If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (55ed8dc4c0467877e129dc4b2035e154dc4fec24bfda412d649fa02ed7150133)
On `npm install`, the package's postinstall script (duplicated in the main module) executes shell commands to collect host identity (`id`, `hostname`, `pwd`), locates n8n installation directories, enumerates running n8n processes, and reads n8n-related environment variables. The collected output is base64-encoded and sent via HTTPS GET to the hardcoded endpoint `https://jasabersama.id/portfolio-data.php` with TLS certificate validation disabled (`rejectUnauthorized: false`). The request includes a static key parameter `k=S7k9xQ2mZj` and a `c=` parameter containing a shell command payload (`echo <base64> | base64 -d >> /tmp/n8n_rce_result.txt`), and the endpoint filename plus payload shape indicate an RCE staging harness. The package's advertised utility helper purpose is a cover; the only substantive content is the install-time recon and beacon.