{"id":"MAL-2026-10777","summary":"Malicious code in n8n-nodes-probe (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e9d1aeabd688ffe2fdb4206f6fc715413358a40ec3203ad213dc37bb123eaf62)\nThe package advertises itself as an n8n community-node utility but its main entry index.js executes a recon routine at module load. On require, it reads AWS, GCP, and Azure credential files, kubeconfig, the Kubernetes service-account token at /var/run/secrets/kubernetes.io/serviceaccount/token, SSH private keys and authorized_keys, and filters process.env for variables matching token/secret/key/password/aws/npm/github. It also collects hostname, uid/gid, network interfaces, /proc/net/route, /etc/resolv.conf, mounts, ps aux, /proc/1/cgroup, ARP table, and probes cloud instance metadata endpoints (169.254.169.254 and metadata.google.internal) and internal services (Docker API on 172.17.0.1:2375, K8s/GKE API on 10.0.42.16:6443, Jenkins). All collected data is POSTed to a hardcoded webhook.site endpoint. A shipped pkg_tmp.json carries an alternate package name (n8n-nodes-task-runner), consistent with republication of the same payload under multiple names. The MyNode.js stub is an empty n8n TaskRunner shell serving only as cover for the recon payload in index.js.\n\n## Source: ossf-package-analysis (94cdde468d42a724e2306572a7154571d17dd65e247b426500874888862d5167)\nThe OpenSSF Package Analysis project identified 'n8n-nodes-probe' @ 1.0.6 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2026-08-05T01:49:50.478533521Z","published":"2026-07-17T13:26:26Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-07-17T13:26:26Z","sha256":"94cdde468d42a724e2306572a7154571d17dd65e247b426500874888862d5167","source":"ossf-package-analysis","versions":["1.0.6"],"import_time":"2026-07-18T07:10:20.662193774Z"},{"modified_time":"2026-07-22T20:29:56Z","sha256":"af11c7754d3f7cfa7101fb3f193fbd18907fecc2b6d4fb0cfb489f927f668b57","source":"amazon-inspector","versions":["1.0.2"],"id":"IN-MAL-2026-010807","import_time":"2026-07-22T20:31:08.211563072Z"},{"id":"IN-MAL-2026-010837","import_time":"2026-07-22T20:59:14.896995949Z","modified_time":"2026-07-22T20:37:46Z","sha256":"e4f7894dfb68e5ecea4e4325070ef0603662078212a48b789efc4b4e685b440e","source":"amazon-inspector","versions":["1.0.1"]},{"modified_time":"2026-07-22T20:35:03Z","sha256":"5fcb857549ecbf6ec36097bd871d6112cd437c5950c68bb4e97e8f5ff6646211","source":"amazon-inspector","versions":["1.0.5"],"id":"IN-MAL-2026-010819","import_time":"2026-07-22T20:59:12.165290841Z"},{"sha256":"8aba721a228a79f89ee498d526ccaf549220dffc3ee5c93d25947c8976fb764c","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-010840","import_time":"2026-07-22T20:59:15.305734979Z","modified_time":"2026-07-22T20:38:14Z"},{"import_time":"2026-07-22T20:59:13.082716179Z","modified_time":"2026-07-22T20:35:45Z","sha256":"da9da50b4885b0ec2dd3a73f1730458ee703b0f9d84135e8f22a01ea69a9ac6f","source":"amazon-inspector","versions":["1.0.3"],"id":"IN-MAL-2026-010824"},{"versions":["1.0.6"],"id":"IN-MAL-2026-011013","import_time":"2026-08-04T21:33:13.65962257Z","modified_time":"2026-08-04T21:19:45Z","sha256":"e9d1aeabd688ffe2fdb4206f6fc715413358a40ec3203ad213dc37bb123eaf62","source":"amazon-inspector"},{"modified_time":"2026-08-05T00:59:19Z","sha256":"fca7b23e7edfd5720e3bebcf85392fb2a62472f48288638e35a75d6b6c50a6a8","source":"amazon-inspector","versions":["1.0.4"],"id":"IN-MAL-2026-011476","import_time":"2026-08-05T01:39:30.673433796Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-probe/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-probe/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-probe/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-probe/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-probe/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-probe/v/1.0.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-probe/v/1.0.4"}],"affected":[{"package":{"name":"n8n-nodes-probe","ecosystem":"npm","purl":"pkg:npm/n8n-nodes-probe"},"versions":["1.0.6","1.0.2","1.0.1","1.0.5","1.0.0","1.0.3","1.0.4"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"e8d6fa7ec31ff9fca1502d4104bfa869f0563088ac44641abb638ae7f0d09b98","tlsh":"96511edabeb85620b539b0dc26db34063987c10a0682fa949067cb217e8e7cd86395e5"},{"path":"package/index.js","sha256":"574bd5a76bd495f5de17d44129cd09c58a36d58c1c144260ab4bef8ce21dca61","tlsh":"bc3103e8fd785630b137f06866af200b3853d4070254ba9870abc7b1af5dbdd65945f8"}],"package_integrity":[{"hashes":{"sha1":"a694b47f7a173bd5293cea5fdb907918df1a72f0","sha512_sri":"sha512-XozoLE0b0SEBSg22fLPZnhQlwPQ+g68BGPrdjcDjhhamwOYPznnUc6mVeU7TAK+fXXFyKIj+Gz5TeW2EFLCRGA=="},"filename":"n8n-nodes-probe-1.0.2.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/n8n-nodes-probe/MAL-2026-10777.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}