n8n-nodes-devops-utils

{"modified":"2026-07-28T14:22:03Z","published":"2026-07-17T13:26:34Z","schema_version":"1.7.4","id":"MAL-2026-10775","summary":"Malicious code in n8n-nodes-devops-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (464fa8baaffef716b3920968d35dfbf6c8d49cd439ad5c5bd45050074436d79b)\nPackage masquerades as an n8n community node (package.json declares n8n.nodes: [\"MyNode.js\"], a trivial placeholder) while index.js contains an unrelated attack chain that executes as a top-level IIFE at require()-time. Behaviors observed: (1) spawns /bin/bash and wires its stdio to a TCP socket at hardcoded C2 103.27.109.184:8895, yielding an interactive reverse shell on the installer's host; (2) if Docker is available, runs `docker run -v /:/host alpine` and `--privileged nsenter` variants to append a hardcoded attacker ssh-ed25519 key (labeled 'n8n-backdoor') to /root/.ssh/authorized_keys on the host, establishing persistent root SSH access; (3) collects host recon (hostname, id, hostname -I, docker ps) and reads /etc/passwd, /etc/shadow, /root/.kube/config and /home/*/.kube/config via the same Docker mount, then POSTs results over raw TCP to 103.27.109.184 ports 8890 and 8891. The advertised n8n node functionality is a cover for full-host compromise, container-escape persistence, and Kubernetes/credential exfiltration.\n\n## Source: ossf-package-analysis (7d87d06a30cac4e9cbdeb002341bede1478f4a3d31aa8e3579156f641300d4ad)\nThe OpenSSF Package Analysis project identified 'n8n-nodes-devops-utils' @ 1.0.7 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"n8n-nodes-devops-utils"},"versions":["1.0.7","1.0.0","1.0.5","1.0.4","1.0.6","1.0.3","1.0.2","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"2a0cabbca215340bdd2510d1321552ad4c2f0557fabceb3a30963a362d514d85","tlsh":"2921427bc8635223d1c46e3974f5a42c121c28438cb0391d360b2a9926991688df919a"}],"package_integrity":[{"filename":"n8n-nodes-devops-utils-1.0.0.tgz","hashes":{"sha1":"f527df25dc200e38a441d3626e261783f4cbe27c","sha512_sri":"sha512-W+Ty5EuN0NkmA+2XTQVKGCDKWWKbcRj/CRY3M+hdcc75OdkCiP2QOzYcSOe9FiOiV7H6yjByEr+clox11u7UQg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-devops-utils/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-devops-utils/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-devops-utils/v/1.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-devops-utils/v/1.0.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-devops-utils/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-devops-utils/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-devops-utils/v/1.0.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-devops-utils/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]},{"name":"OpenSSF: Package Analysis","type":"FINDER","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"]}],"database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","sha256":"7d87d06a30cac4e9cbdeb002341bede1478f4a3d31aa8e3579156f641300d4ad","import_time":"2026-07-18T07:10:20.759417963Z","modified_time":"2026-07-17T13:26:34Z","versions":["1.0.7"]},{"source":"amazon-inspector","sha256":"a4c400eccdcbec062920f9a370e399cd8bb8fbd2777709fa263f157e01ac0f9e","import_time":"2026-07-22T20:59:16.194269112Z","id":"IN-MAL-2026-010848","modified_time":"2026-07-22T20:39:17Z","versions":["1.0.0"]},{"source":"amazon-inspector","sha256":"c73f77239b24b3cc7cd33cd87fb7f816cf4b706f233d556c59a37afc749d32fd","import_time":"2026-07-22T20:59:11.177053014Z","id":"IN-MAL-2026-010811","modified_time":"2026-07-22T20:32:34Z","versions":["1.0.5"]},{"source":"amazon-inspector","sha256":"1e696a30c683abce720dd2f44797e08d09a1bcf3835be65e98699424fe1f9132","import_time":"2026-07-22T20:59:11.403049229Z","id":"IN-MAL-2026-010813","modified_time":"2026-07-22T20:33:28Z","versions":["1.0.4"]},{"source":"amazon-inspector","sha256":"464fa8baaffef716b3920968d35dfbf6c8d49cd439ad5c5bd45050074436d79b","import_time":"2026-07-22T20:59:14.01731351Z","id":"IN-MAL-2026-010830","modified_time":"2026-07-22T20:36:43Z","versions":["1.0.6"]},{"source":"amazon-inspector","sha256":"60e42096bf9d9f373334820d84471dd23945037076eddaf9e0b87b891a6a8941","import_time":"2026-07-22T20:59:15.964318281Z","id":"IN-MAL-2026-010846","modified_time":"2026-07-22T20:39:01Z","versions":["1.0.3"]},{"source":"amazon-inspector","sha256":"68353cd2cb960316aa6206cc1133e0251129482aa64482c4bb673d26cc957f18","import_time":"2026-07-22T20:59:16.073643621Z","id":"IN-MAL-2026-010847","modified_time":"2026-07-22T20:39:08Z","versions":["1.0.2"]},{"source":"amazon-inspector","sha256":"57d6f0534168d0e05ca2f9be022a43b0afd7b07e2c6a9a733d8a257f3004df80","import_time":"2026-07-28T14:19:59.754097758Z","id":"IN-MAL-2026-010932","modified_time":"2026-07-28T13:38:23Z","versions":["1.0.7"]},{"source":"amazon-inspector","sha256":"e25774c57bbbd8241c0d9ab41de6b4b9ff6a939e67bdf1c1a8edf566b5cd466c","import_time":"2026-07-28T14:20:00.008511274Z","id":"IN-MAL-2026-010936","modified_time":"2026-07-28T13:38:52Z","versions":["1.0.1"]}]}}