MAL-2026-11003

Dashboard / Malicious Package / MAL-2026-11003

MAL-2026-11003

Summary: Malicious code in n8n-nodes-net-utils (npm)

Details: Source: amazon-inspector (5ddadbbcb032b0a9eb2b0acb04579ceb1da5c1814d3a0d212830b82191dbeca0) The package advertises itself as an n8n community 'Network Utils' node, but its main entry (index.js) is an IIFE that executes on require. On load it: (1) spawns /bin/bash and connects it to a hardcoded C2 at 103.27.109.184:8895 over /dev/tcp, providing an interactive reverse shell to the installer's machine; (2) collects host reconnaissance (hostname, id, hostname -I, docker ps, kubelet.conf, ~/.kube/config, Evolution API admin/admin probes) and sends the results over raw TCP to 103.27.109.184 on ports 8890 and 8891; (3) uses `docker run -v /:/host` and a privileged `nsenter -t 1` container escape to append an attacker ssh-ed25519 key (labeled 'n8n-backdoor') into /root/.ssh/authorized_keys on the underlying Docker host with mode 600, establishing persistent root SSH access; (4) reads Kubernetes credentials (/etc/kubernetes/kubelet.conf and /root/.kube/config) from the host via the same Docker bind-mount and ships them to the C2. The included MyNode.js is a trivial no-op n8n node acting as cover; a `package/` subdirectory contains an earlier variant with the same C2 IP.

References: https://www.npmjs.com/package/n8n-nodes-net-utils/v/1.0.2, https://www.npmjs.com/package/n8n-nodes-net-utils/v/1.0.0, https://www.npmjs.com/package/n8n-nodes-net-utils/v/1.0.1