{"id":"MAL-2026-11005","summary":"Malicious code in n8n-nodes-quick-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1a3ad37cc152517b09b8ee72a009a179399ddf802e7f22c126c9d104b4252d5a)\nOn require/import, index.js spawns /bin/bash wired to a TCP socket at hardcoded IP 103.27.109.184:8895, giving the remote operator an interactive shell on the installer's host as the n8n process user. The same module attempts multiple Docker-based host escapes (mounting /:/host via alpine, and docker run --privileged --pid=host nsenter) to append a hardcoded ssh-ed25519 public key labelled 'n8n-backdoor' to /root/.ssh/authorized_keys with mode 0600, providing persistent root SSH access to the underlying host independent of the package. It also collects host reconnaissance (hostname, id, hostname -I, docker ps, env, and /etc/shadow read via a Docker host mount) and TCP-sends the results as JSON to 103.27.109.184:8890 and:8891. Additional code reads /host/etc/kubernetes/kubelet.conf and /host/root/.kube/config through the Docker mount and forwards their contents to the same C2, and execs into a specific local container to credential-stuff admin@admin.com/admin against the Evolution API at http://localhost:8080/manager/auth/login and http://172.18.0.2:8080/manager/auth/login, relaying the response to the C2. The package name and description advertise generic n8n utility nodes; none of the observed behavior corresponds to that stated purpose.\n","modified":"2026-07-23T07:52:01.964692309Z","published":"2026-07-22T20:32:15Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.2"],"id":"IN-MAL-2026-010825","import_time":"2026-07-22T20:59:13.232280758Z","modified_time":"2026-07-22T20:35:58Z","sha256":"1a3ad37cc152517b09b8ee72a009a179399ddf802e7f22c126c9d104b4252d5a"},{"sha256":"ef60cde3bd5f967ec607360d49ba75951f13a4bb7e0fd33dd10f3fcd6b518e07","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-010842","import_time":"2026-07-22T20:59:15.546546088Z","modified_time":"2026-07-22T20:38:28Z"},{"import_time":"2026-07-22T20:59:11.07442827Z","modified_time":"2026-07-22T20:32:15Z","sha256":"9c1e1f60ab1572824797a5a46ba3ec4c282dcbdc827c08da1867098a24c9246a","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-010810"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-quick-utils/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-quick-utils/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-quick-utils/v/1.0.1"}],"affected":[{"package":{"name":"n8n-nodes-quick-utils","ecosystem":"npm","purl":"pkg:npm/n8n-nodes-quick-utils"},"versions":["1.0.2","1.0.0","1.0.1"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"e8d6fa7ec31ff9fca1502d4104bfa869f0563088ac44641abb638ae7f0d09b98","tlsh":"96511edabeb85620b539b0dc26db34063987c10a0682fa949067cb217e8e7cd86395e5","path":"index.js"}],"package_integrity":[{"filename":"n8n-nodes-quick-utils-1.0.2.tgz","hashes":{"sha1":"d4b1e5dfcb512782944c89c78c6d272930bc9aab","sha512_sri":"sha512-+xCFKCy2tBd2pEZRbbWabrHTtl1t34iLzBRERNN0UTD2X5abguYJrkQ1uzS8jGr4SpIikr/IDz3h3akYyv6T3w=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/n8n-nodes-quick-utils/MAL-2026-11005.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}