MAL-2026-10777

Dashboard / Malicious Package / MAL-2026-10777

MAL-2026-10777

Summary: Malicious code in n8n-nodes-probe (npm)

Details: Source: amazon-inspector (e9d1aeabd688ffe2fdb4206f6fc715413358a40ec3203ad213dc37bb123eaf62) The package advertises itself as an n8n community-node utility but its main entry index.js executes a recon routine at module load. On require, it reads AWS, GCP, and Azure credential files, kubeconfig, the Kubernetes service-account token at /var/run/secrets/kubernetes.io/serviceaccount/token, SSH private keys and authorized_keys, and filters process.env for variables matching token/secret/key/password/aws/npm/github. It also collects hostname, uid/gid, network interfaces, /proc/net/route, /etc/resolv.conf, mounts, ps aux, /proc/1/cgroup, ARP table, and probes cloud instance metadata endpoints (169.254.169.254 and metadata.google.internal) and internal services (Docker API on 172.17.0.1:2375, K8s/GKE API on 10.0.42.16:6443, Jenkins). All collected data is POSTed to a hardcoded webhook.site endpoint. A shipped pkg_tmp.json carries an alternate package name (n8n-nodes-task-runner), consistent with republication of the same payload under multiple names. The MyNode.js stub is an empty n8n TaskRunner shell serving only as cover for the recon payload in index.js. Source: ossf-package-analysis (94cdde468d42a724e2306572a7154571d17dd65e247b426500874888862d5167) The OpenSSF Package Analysis project identified 'n8n-nodes-probe' @ 1.0.6 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

References: https://www.npmjs.com/package/n8n-nodes-probe/v/1.0.2, https://www.npmjs.com/package/n8n-nodes-probe/v/1.0.1, https://www.npmjs.com/package/n8n-nodes-probe/v/1.0.5, https://www.npmjs.com/package/n8n-nodes-probe/v/1.0.0, https://www.npmjs.com/package/n8n-nodes-probe/v/1.0.3, https://www.npmjs.com/package/n8n-nodes-probe/v/1.0.6, https://www.npmjs.com/package/n8n-nodes-probe/v/1.0.4