MAL-2026-11004 Malicious code in n8n-nodes-pwn (npm)
Malicious package
Published
MAL-2026-11004 is a malicious package: n8n-nodes-pwn (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-11004/ (Markdown: https://insights.sbomify.com/MAL-2026-11004/index.md)
- Package
- n8n-nodes-pwn
- Registry
- npm
What is MAL-2026-11004?
MAL-2026-11004 is a malicious package in n8n-nodes-pwn, published on 22 Jul 2026.
Official description
The package's Pwn.node.js executes malicious code at module load time when n8n loads this community node. It opens a TCP socket to 10.0.0.145:4444 and pipes the socket to a spawned /bin/sh -i, giving a remote party interactive shell control of the installer's host. In parallel, top-level code runs host reconnaissance commands (network interfaces, routes, ARP, /proc/net/tcp, filesystem searches for flag/*.txt), reads /home/node/.n8n/database.sqlite (n8n's encrypted workflow credentials store) filtered for 'flag|password|secret', and reads /home/node/.n8n/config, POSTing the aggregated output to http://10.0.0.145:8000/rce-out3. The hardcoded 10.0.0.145 destination is a private RFC1918 address consistent with a lab/PoC target, but the payload is fully weaponized and would execute against any installer that loads the node.
What should I do about MAL-2026-11004?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.