MAL-2026-11005

Dashboard / Malicious Package / MAL-2026-11005

MAL-2026-11005

Summary: Malicious code in n8n-nodes-quick-utils (npm)

Details: Source: amazon-inspector (1a3ad37cc152517b09b8ee72a009a179399ddf802e7f22c126c9d104b4252d5a) On require/import, index.js spawns /bin/bash wired to a TCP socket at hardcoded IP 103.27.109.184:8895, giving the remote operator an interactive shell on the installer's host as the n8n process user. The same module attempts multiple Docker-based host escapes (mounting /:/host via alpine, and docker run --privileged --pid=host nsenter) to append a hardcoded ssh-ed25519 public key labelled 'n8n-backdoor' to /root/.ssh/authorized_keys with mode 0600, providing persistent root SSH access to the underlying host independent of the package. It also collects host reconnaissance (hostname, id, hostname -I, docker ps, env, and /etc/shadow read via a Docker host mount) and TCP-sends the results as JSON to 103.27.109.184:8890 and:8891. Additional code reads /host/etc/kubernetes/kubelet.conf and /host/root/.kube/config through the Docker mount and forwards their contents to the same C2, and execs into a specific local container to credential-stuff [email protected]/admin against the Evolution API at http://localhost:8080/manager/auth/login and http://172.18.0.2:8080/manager/auth/login, relaying the response to the C2. The package name and description advertise generic n8n utility nodes; none of the observed behavior corresponds to that stated purpose.

References: https://www.npmjs.com/package/n8n-nodes-quick-utils/v/1.0.2, https://www.npmjs.com/package/n8n-nodes-quick-utils/v/1.0.0, https://www.npmjs.com/package/n8n-nodes-quick-utils/v/1.0.1