n8n-nodes-net-utils

GHSA-mjcx-m95h-469m

Malicious code in n8n-nodes-net-utils (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.2`

## Source: amazon-inspector (5ddadbbcb032b0a9eb2b0acb04579ceb1da5c1814d3a0d212830b82191dbeca0)
The package advertises itself as an n8n community 'Network Utils' node, but its main entry (index.js) is an IIFE that executes on require. On load it: (1) spawns /bin/bash and connects it to a hardcoded C2 at 103.27.109.184:8895 over /dev/tcp, providing an interactive reverse shell to the installer's machine; (2) collects host reconnaissance (hostname, id, hostname -I, docker ps, kubelet.conf, ~/.kube/config, Evolution API admin/admin probes) and sends the results over raw TCP to 103.27.109.184 on ports 8890 and 8891; (3) uses `docker run -v /:/host` and a privileged `nsenter -t 1` container escape to append an attacker ssh-ed25519 key (labeled 'n8n-backdoor') into /root/.ssh/authorized_keys on the underlying Docker host with mode 600, establishing persistent root SSH access; (4) reads Kubernetes credentials (/etc/kubernetes/kubelet.conf and /root/.kube/config) from the host via the same Docker bind-mount and ships them to the C2. The included MyNode.js is a trivial no-op n8n node acting as cover; a `package/` subdirectory contains an earlier variant with the same C2 IP.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/11d3fe86e64bc222b3148fee7be5b337ee8c3c0f/osv/malicious/npm/n8n-nodes-net-utils/MAL-2026-11003.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/11d3fe86e64bc222b3148fee7be5b337ee8c3c0f/osv/malicious/npm/n8n-nodes-net-utils/MAL-2026-11003.json
- https://www.npmjs.com/package/n8n-nodes-net-utils/v/1.0.0
- https://www.npmjs.com/package/n8n-nodes-net-utils/v/1.0.1
- https://www.npmjs.com/package/n8n-nodes-net-utils/v/1.0.2
- https://github.com/advisories/GHSA-mjcx-m95h-469m

Compromised versions (1)

= 1.0.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.