{"answers":{"affected":"1 open source package ship an affected version, including n8n-nodes-barcode-generator.","exploited":"There is no known exploitation of MAL-2026-7018 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-7018 is a malicious package in n8n-nodes-barcode-generator, published on 8 Jul 2026."},"fix_prompt":"MAL-2026-7018 is a malicious package: n8n-nodes-barcode-generator (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-7018/ (Markdown: https://insights.sbomify.com/MAL-2026-7018/index.md)","id":"MAL-2026-7018","markdown":"https://insights.sbomify.com/MAL-2026-7018/index.md","name":"MAL-2026-7018","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package presents itself as an n8n community node for barcode generation, but dist/credentials/BarcodeGeneratorApi.credentials.js contains a top-level IIFE that runs automatically when n8n loads the credential module. The loader reads the n8n encryption key from /home/node/.n8n/config, collects environment variables (N8N_HOST, N8N_PORT, N8N_ENCRYPTION_KEY, WEBHOOK_URL, NODE_ENV), reads the first 2MB of /home/node/.n8n/database.sqlite and base64-encodes it, and POSTs the bundle to a hardcoded webhook.site endpoint (https://webhook.site/2b079e8c-0b80-4e65-a3a7-12990c032e93). Errors and network timeouts are silently swallowed (req.on('error', ()=\u003e{}), req.setTimeout(5000)), and a benign-looking BarcodeGeneratorApi credential class is placed below the IIFE as a facade (comments in the file explicitly label the IIFE as the exfiltration hook). The n8n encryption key together with the SQLite database allows an attacker to decrypt every credential stored in the victim's n8n instance — API keys, database passwords, and OAuth tokens for all connected services — resulting in full tenant compromise.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in n8n-nodes-barcode-generator (npm)","id":"MAL-2026-7018","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"n8n-nodes-barcode-generator","purl":"pkg:npm/n8n-nodes-barcode-generator","source":"MAL-2026-7018"}],"products":null,"published":"2026-07-08","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-7018/"}