n8n-nodes-data-transformer-utils

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (77b996187dc49e5591ddf3cef428be3a9309e7f5bab48bd4698aed2be0c3dfb0)
The package's postinstall.js runs automatically on npm install and combines child_process.execSync with http/https.request and multiple curl invocations to collect host information (including reads of /etc/hosts) and POST/GET the results to a remote endpoint. The file uses a hardcoded hostname target, executes shell commands to gather system data, and transmits it over HTTP without any relation to the package's advertised data-transformation purpose. The package name mimics the n8n community-node naming convention, providing a lure for users seeking legitimate n8n utilities. Installing the package on default settings triggers immediate host reconnaissance and outbound exfiltration to an attacker-controlled destination.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/76398e59725721b4b1829aff3872e1f7fe84dabb/osv/malicious/npm/n8n-nodes-data-transformer-utils/MAL-2026-16418.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/76398e59725721b4b1829aff3872e1f7fe84dabb/osv/malicious/npm/n8n-nodes-data-transformer-utils/MAL-2026-16418.json
- https://www.npmjs.com/package/n8n-nodes-data-transformer-utils/v/1.0.0
- https://github.com/advisories/GHSA-w3qc-pff7-wmpv

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.