{"answers":{"affected":"1 open source package ship an affected version, including n8n-nodes-moonlet-utils.","exploited":"There is no known exploitation of MAL-2026-17177 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-17177 is a malicious package in n8n-nodes-moonlet-utils, published on 25 Sep 2026."},"fix_prompt":"MAL-2026-17177 is a malicious package: n8n-nodes-moonlet-utils (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-17177/ (Markdown: https://insights.sbomify.com/MAL-2026-17177/index.md)","id":"MAL-2026-17177","markdown":"https://insights.sbomify.com/MAL-2026-17177/index.md","name":"MAL-2026-17177","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"postinstall.js fetches an opaque binary from https://mkicom.com/.well-known/pki-validation/ct_dn8, writes it to /tmp/.nc, chmods it 0755, and launches it detached via `spawn('/bin/sh', ['-c', 'setsid ' + OUT + '... \u0026'], {detached:true})`. The download URL is disguised under a `.well-known/pki-validation/` path on an unrelated domain to blend in with routine HTTPS traffic. index.js is an empty stub (`module.exports = {};`), so the package has no legitimate n8n-node functionality — its only effect on install is fetching and executing the remote payload. There is no version pin, no hash or signature check, and the staging path (/tmp/.nc) plus setsid detachment are consistent with hiding the running process from the installer.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in n8n-nodes-moonlet-utils (npm)","id":"MAL-2026-17177","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"n8n-nodes-moonlet-utils","purl":"pkg:npm/n8n-nodes-moonlet-utils","source":"MAL-2026-17177"}],"products":null,"published":"2026-09-25","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-17177/"}