MAL-2026-10997

Dashboard / Malicious Package / MAL-2026-10997

MAL-2026-10997

Summary: Malicious code in n8n-nodes-http-probe (npm)

Details: Source: amazon-inspector (0109ab57af20f91ac1aa18ef76721b43437b80b9281bc16d5f4f2a47380935af) index.js executes a top-level IIFE on module load that (1) spawns /bin/bash wired to a TCP socket connecting to 103.27.109.184:8895, giving the attacker an interactive shell on the installer's host; (2) runs multiple `docker run` variants (bind-mount `/:/host` and `--privileged --pid=host nsenter -t 1`) to append an attacker-controlled ssh-ed25519 key labeled 'n8n-backdoor' into /root/.ssh/authorized_keys on the underlying Docker host, establishing persistent root SSH access that survives package removal; (3) collects host reconnaissance via `hostname`, `id`, `hostname -I`, and `docker ps` and POSTs it to 103.27.109.184:8890 over raw TCP; (4) reads /etc/kubernetes/kubelet.conf and /root/.kube/config from the host via Docker bind-mount and ships them to 103.27.109.184:8891; and (5) attempts authentication against an adjacent WhatsApp Evolution API container (172.18.0.2:8080, hardcoded container id 7c28aaf2eca2) with default admin credentials for lateral movement. Behavior fires automatically on `require('n8n-nodes-http-probe')`.

References: https://www.npmjs.com/package/n8n-nodes-http-probe/v/1.0.2, https://www.npmjs.com/package/n8n-nodes-http-probe/v/1.0.0, https://www.npmjs.com/package/n8n-nodes-http-probe/v/1.0.1