n8n-nodes-net-utils

{"modified":"2026-07-22T21:05:27Z","published":"2026-07-22T20:36:06Z","schema_version":"1.7.4","id":"MAL-2026-11003","summary":"Malicious code in n8n-nodes-net-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5ddadbbcb032b0a9eb2b0acb04579ceb1da5c1814d3a0d212830b82191dbeca0)\nThe package advertises itself as an n8n community 'Network Utils' node, but its main entry (index.js) is an IIFE that executes on require. On load it: (1) spawns /bin/bash and connects it to a hardcoded C2 at 103.27.109.184:8895 over /dev/tcp, providing an interactive reverse shell to the installer's machine; (2) collects host reconnaissance (hostname, id, hostname -I, docker ps, kubelet.conf, ~/.kube/config, Evolution API admin/admin probes) and sends the results over raw TCP to 103.27.109.184 on ports 8890 and 8891; (3) uses `docker run -v /:/host` and a privileged `nsenter -t 1` container escape to append an attacker ssh-ed25519 key (labeled 'n8n-backdoor') into /root/.ssh/authorized_keys on the underlying Docker host with mode 600, establishing persistent root SSH access; (4) reads Kubernetes credentials (/etc/kubernetes/kubelet.conf and /root/.kube/config) from the host via the same Docker bind-mount and ships them to the C2. The included MyNode.js is a trivial no-op n8n node acting as cover; a `package/` subdirectory contains an earlier variant with the same C2 IP.\n","affected":[{"package":{"ecosystem":"npm","name":"n8n-nodes-net-utils"},"versions":["1.0.2","1.0.0","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"e8d6fa7ec31ff9fca1502d4104bfa869f0563088ac44641abb638ae7f0d09b98","tlsh":"96511edabeb85620b539b0dc26db34063987c10a0682fa949067cb217e8e7cd86395e5"},{"path":"package.json","sha256":"c085e8fefcaab36ce1200d2c573f6eb29bd4d8c215ea347470979243edf09c2f","tlsh":"ffd023150d33da3311c49e513a7e96153a690ca68088f9199747181943ad6f714fa21c"}],"package_integrity":[{"filename":"n8n-nodes-net-utils-1.0.2.tgz","hashes":{"sha1":"688d8bcf058bdb2fcbc51e9130e0c480e282e610","sha512_sri":"sha512-LoJ5WstVxeHcxpUorwOAJfLtGJmdXlIXWVut+YWrfJs4FmDaa1g8SE4UxpslPqF4akhdDWNgXanKflC1eT3qhg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-net-utils/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-net-utils/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-net-utils/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010826","import_time":"2026-07-22T20:59:13.392690618Z","modified_time":"2026-07-22T20:36:06Z","sha256":"5ddadbbcb032b0a9eb2b0acb04579ceb1da5c1814d3a0d212830b82191dbeca0","source":"amazon-inspector","versions":["1.0.2"]},{"id":"IN-MAL-2026-010841","import_time":"2026-07-22T20:59:15.447644146Z","modified_time":"2026-07-22T20:38:21Z","sha256":"ee47947db4cba8f586ba57b7efd47b9065a59b0f4bc992d26ad6dfb84617403a","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-010839","import_time":"2026-07-22T20:59:15.147353421Z","modified_time":"2026-07-22T20:38:03Z","sha256":"f6ac70eee44c61024909cdc0e5295a015cd2cbbfbec1fa3f498cc5e64497603a","source":"amazon-inspector","versions":["1.0.1"]}]}}