n8n-nodes-http-probe

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (0109ab57af20f91ac1aa18ef76721b43437b80b9281bc16d5f4f2a47380935af)
index.js executes a top-level IIFE on module load that (1) spawns /bin/bash wired to a TCP socket connecting to 103.27.109.184:8895, giving the attacker an interactive shell on the installer's host; (2) runs multiple `docker run` variants (bind-mount `/:/host` and `--privileged --pid=host nsenter -t 1`) to append an attacker-controlled ssh-ed25519 key labeled 'n8n-backdoor' into /root/.ssh/authorized_keys on the underlying Docker host, establishing persistent root SSH access that survives package removal; (3) collects host reconnaissance via `hostname`, `id`, `hostname -I`, and `docker ps` and POSTs it to 103.27.109.184:8890 over raw TCP; (4) reads /etc/kubernetes/kubelet.conf and /root/.kube/config from the host via Docker bind-mount and ships them to 103.27.109.184:8891; and (5) attempts authentication against an adjacent WhatsApp Evolution API container (172.18.0.2:8080, hardcoded container id 7c28aaf2eca2) with default admin credentials for lateral movement. Behavior fires automatically on `require('n8n-nodes-http-probe')`.

Compromised versions (3)

• 1.0.2
• 1.0.0
• 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.