MAL-2026-10776 Malicious code in n8n-nodes-final-mile (npm)

The package advertises itself as a community utility node for n8n but its declared main (index.js) is a self-executing IIFE that runs the moment n8n loads the module. On execution it (1) opens a reverse shell by spawning /bin/bash with stdio redirected via /dev/tcp to 103.27.109.184:8895, giving the operator of that host interactive root-level control of the installer; (2) attempts multiple Docker-based container escapes (bind-mounting the host root filesystem, and –privileged nsenter) to append a hardcoded attacker ssh-ed25519 public key labeled 'n8n-backdoor' to /root/.ssh/authorized_keys on the underlying host for persistent SSH access; (3) collects hostname, user id, network interfaces, docker ps output, environment variables, and the contents of /etc/shadow, /etc/kubernetes/kubelet.conf, and /root/.kube/config obtained via the Docker escape, and posts the results as JSON over TCP to 103.27.109.184 on ports 8890 and 8891. A separate MyNode.js file is a benign-looking stub referenced by package.json's n8n.nodes to serve as cover while index.js carries the payload.

The OpenSSF Package Analysis project identified 'n8n-nodes-final-mile' @ 1.0.5 (npm) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.