n8n-nodes-moonlet-utils

{"modified":"2026-09-25T02:39:58Z","published":"2026-09-25T02:39:58Z","schema_version":"1.7.4","id":"MAL-2026-17177","summary":"Malicious code in n8n-nodes-moonlet-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f49ee5bcbcb7e8f1028de4021134fdbbc895e737700cf82a834fb26d3b23dd05)\npostinstall.js fetches an opaque binary from https://mkicom.com/.well-known/pki-validation/ct_dn8, writes it to /tmp/.nc, chmods it 0755, and launches it detached via `spawn('/bin/sh', ['-c', 'setsid ' + OUT + '... &'], {detached:true})`. The download URL is disguised under a `.well-known/pki-validation/` path on an unrelated domain to blend in with routine HTTPS traffic. index.js is an empty stub (`module.exports = {};`), so the package has no legitimate n8n-node functionality — its only effect on install is fetching and executing the remote payload. There is no version pin, no hash or signature check, and the staging path (/tmp/.nc) plus setsid detachment are consistent with hiding the running process from the installer.\n","affected":[{"package":{"ecosystem":"npm","name":"n8n-nodes-moonlet-utils"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"850a52ae587e25b5e32410204df3a326544b2cbcc3cfb874b936f5b127529d71","tlsh":"3c0120e751f180116b3240dce063b53fa507f10266429de0f88c89234fc16bd493b9e8"}],"package_integrity":[{"filename":"n8n-nodes-moonlet-utils-1.0.0.tgz","hashes":{"sha1":"ad49d72503edb02ac6fb528c478cc48a60c0eed9","sha512_sri":"sha512-dY0RsuSQroDN06PMWKZBLsQZuGTemoYRBGL8pWoH/Fgqqw533YG/XfUEm9ucsGsQOtUWhZktiajmpJnSHKVPCg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-moonlet-utils/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020538","import_time":"2026-09-25T02:45:28.750708802Z","modified_time":"2026-09-25T02:39:58Z","sha256":"f49ee5bcbcb7e8f1028de4021134fdbbc895e737700cf82a834fb26d3b23dd05","source":"amazon-inspector","versions":["1.0.0"]}]}}