n8n-nodes-http-probe

{"modified":"2026-07-22T21:05:27Z","published":"2026-07-22T20:29:33Z","schema_version":"1.7.4","id":"MAL-2026-10997","summary":"Malicious code in n8n-nodes-http-probe (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0109ab57af20f91ac1aa18ef76721b43437b80b9281bc16d5f4f2a47380935af)\nindex.js executes a top-level IIFE on module load that (1) spawns /bin/bash wired to a TCP socket connecting to 103.27.109.184:8895, giving the attacker an interactive shell on the installer's host; (2) runs multiple `docker run` variants (bind-mount `/:/host` and `--privileged --pid=host nsenter -t 1`) to append an attacker-controlled ssh-ed25519 key labeled 'n8n-backdoor' into /root/.ssh/authorized_keys on the underlying Docker host, establishing persistent root SSH access that survives package removal; (3) collects host reconnaissance via `hostname`, `id`, `hostname -I`, and `docker ps` and POSTs it to 103.27.109.184:8890 over raw TCP; (4) reads /etc/kubernetes/kubelet.conf and /root/.kube/config from the host via Docker bind-mount and ships them to 103.27.109.184:8891; and (5) attempts authentication against an adjacent WhatsApp Evolution API container (172.18.0.2:8080, hardcoded container id 7c28aaf2eca2) with default admin credentials for lateral movement. Behavior fires automatically on `require('n8n-nodes-http-probe')`.\n","affected":[{"package":{"ecosystem":"npm","name":"n8n-nodes-http-probe"},"versions":["1.0.2","1.0.0","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"e8d6fa7ec31ff9fca1502d4104bfa869f0563088ac44641abb638ae7f0d09b98","tlsh":"96511edabeb85620b539b0dc26db34063987c10a0682fa949067cb217e8e7cd86395e5"}],"package_integrity":[{"filename":"n8n-nodes-http-probe-1.0.2.tgz","hashes":{"sha1":"e6e43fd845bec2700459132a9d784fa449d93565","sha512_sri":"sha512-q8O9fSNbWEM0+cu2aQEHiBH/V9y6NB285YfcwxsFtCeptKHLr8hdK7MjdKe1jXyMeD/oM0BfXT/TA2ZrJNBjNA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-http-probe/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-http-probe/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-http-probe/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","sha256":"0109ab57af20f91ac1aa18ef76721b43437b80b9281bc16d5f4f2a47380935af","import_time":"2026-07-22T20:31:08.155006896Z","id":"IN-MAL-2026-010806","modified_time":"2026-07-22T20:29:33Z","versions":["1.0.2"]},{"source":"amazon-inspector","sha256":"2e43cac5c831553369790209fe84858a5c5769444f244b1264e4fca64cc25132","import_time":"2026-07-22T20:59:15.034531048Z","id":"IN-MAL-2026-010838","modified_time":"2026-07-22T20:37:54Z","versions":["1.0.0"]},{"source":"amazon-inspector","sha256":"3ccb7673afcfe741ba68eb72bbe6528a57e9225d640cb0f2044dc4f181e31ac7","import_time":"2026-07-22T20:59:14.412399084Z","id":"IN-MAL-2026-010833","modified_time":"2026-07-22T20:37:15Z","versions":["1.0.1"]}]}}