n8n-nodes-http-probe @1.0.2

Summary

index.js executes a top-level IIFE on module load that (1) spawns /bin/bash wired to a TCP socket connecting to 103.27.109.184:8895, giving the attacker an interactive shell on the installer's host; (2) runs multiple docker run variants (bind-mount /:/host and --privileged --pid=host nsenter -t 1 ) to append an attacker-controlled ssh-ed25519 key labeled 'n8n-backdoor' into /root/.ssh/authorized_keys on the underlying Docker host, establishing persistent root SSH access that survives package removal; (3) collects host reconnaissance via hostname , id , hostname -I , and docker ps and POSTs it to 103.27.109.184:8890 over raw TCP; (4) reads /etc/kubernetes/kubelet.conf and /root/.kube/config from the host via Docker bind-mount and ships them to 103.27.109.184:8891; and (5) attempts authentication against an adjacent WhatsApp Evolution API container (172.18.0.2:8080, hardcoded container id 7c28aaf2eca2) with default admin credentials for lateral movement. Behavior fires automatically on require('n8n-nodes-http-probe') .

Source: amazon-inspector (0109ab57af20f91ac1aa18ef76721b43437b80b9281bc16d5f4f2a47380935af)