MAL-2026-10775

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/n8n-nodes-devops-utils/MAL-2026-10775.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-10775

Published

2026-07-17T13:26:34Z

Modified

2026-07-28T14:37:03Z

Summary

Malicious code in n8n-nodes-devops-utils (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (464fa8baaffef716b3920968d35dfbf6c8d49cd439ad5c5bd45050074436d79b)

Package masquerades as an n8n community node (package.json declares n8n.nodes: ["MyNode.js"], a trivial placeholder) while index.js contains an unrelated attack chain that executes as a top-level IIFE at require()-time. Behaviors observed: (1) spawns /bin/bash and wires its stdio to a TCP socket at hardcoded C2 103.27.109.184:8895, yielding an interactive reverse shell on the installer's host; (2) if Docker is available, runs docker run -v /:/host alpine and --privileged nsenter variants to append a hardcoded attacker ssh-ed25519 key (labeled 'n8n-backdoor') to /root/.ssh/authorized_keys on the host, establishing persistent root SSH access; (3) collects host recon (hostname, id, hostname -I, docker ps) and reads /etc/passwd, /etc/shadow, /root/.kube/config and /home/*/.kube/config via the same Docker mount, then POSTs results over raw TCP to 103.27.109.184 ports 8890 and 8891. The advertised n8n node functionality is a cover for full-host compromise, container-escape persistence, and Kubernetes/credential exfiltration.

Source: ossf-package-analysis (7d87d06a30cac4e9cbdeb002341bede1478f4a3d31aa8e3579156f641300d4ad)

The OpenSSF Package Analysis project identified 'n8n-nodes-devops-utils' @ 1.0.7 (npm) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Database specific

{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-18T07:10:20.759417963Z",
            "modified_time": "2026-07-17T13:26:34Z",
            "sha256": "7d87d06a30cac4e9cbdeb002341bede1478f4a3d31aa8e3579156f641300d4ad",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.7"
            ]
        },
        {
            "id": "IN-MAL-2026-010848",
            "import_time": "2026-07-22T20:59:16.194269112Z",
            "modified_time": "2026-07-22T20:39:17Z",
            "sha256": "a4c400eccdcbec062920f9a370e399cd8bb8fbd2777709fa263f157e01ac0f9e",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-010811",
            "import_time": "2026-07-22T20:59:11.177053014Z",
            "modified_time": "2026-07-22T20:32:34Z",
            "sha256": "c73f77239b24b3cc7cd33cd87fb7f816cf4b706f233d556c59a37afc749d32fd",
            "source": "amazon-inspector",
            "versions": [
                "1.0.5"
            ]
        },
        {
            "id": "IN-MAL-2026-010813",
            "import_time": "2026-07-22T20:59:11.403049229Z",
            "modified_time": "2026-07-22T20:33:28Z",
            "sha256": "1e696a30c683abce720dd2f44797e08d09a1bcf3835be65e98699424fe1f9132",
            "source": "amazon-inspector",
            "versions": [
                "1.0.4"
            ]
        },
        {
            "id": "IN-MAL-2026-010830",
            "import_time": "2026-07-22T20:59:14.01731351Z",
            "modified_time": "2026-07-22T20:36:43Z",
            "sha256": "464fa8baaffef716b3920968d35dfbf6c8d49cd439ad5c5bd45050074436d79b",
            "source": "amazon-inspector",
            "versions": [
                "1.0.6"
            ]
        },
        {
            "id": "IN-MAL-2026-010846",
            "import_time": "2026-07-22T20:59:15.964318281Z",
            "modified_time": "2026-07-22T20:39:01Z",
            "sha256": "60e42096bf9d9f373334820d84471dd23945037076eddaf9e0b87b891a6a8941",
            "source": "amazon-inspector",
            "versions": [
                "1.0.3"
            ]
        },
        {
            "id": "IN-MAL-2026-010847",
            "import_time": "2026-07-22T20:59:16.073643621Z",
            "modified_time": "2026-07-22T20:39:08Z",
            "sha256": "68353cd2cb960316aa6206cc1133e0251129482aa64482c4bb673d26cc957f18",
            "source": "amazon-inspector",
            "versions": [
                "1.0.2"
            ]
        },
        {
            "id": "IN-MAL-2026-010932",
            "import_time": "2026-07-28T14:19:59.754097758Z",
            "modified_time": "2026-07-28T13:38:23Z",
            "sha256": "57d6f0534168d0e05ca2f9be022a43b0afd7b07e2c6a9a733d8a257f3004df80",
            "source": "amazon-inspector",
            "versions": [
                "1.0.7"
            ]
        },
        {
            "id": "IN-MAL-2026-010936",
            "import_time": "2026-07-28T14:20:00.008511274Z",
            "modified_time": "2026-07-28T13:38:52Z",
            "sha256": "e25774c57bbbd8241c0d9ab41de6b4b9ff6a939e67bdf1c1a8edf566b5cd466c",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com
- OpenSSF: Package Analysis - FINDER
- - https://github.com/ossf/package-analysis
  - https://openssf.slack.com/channels/package_analysis

Affected packages

npm / n8n-nodes-devops-utils

Package

Name: n8n-nodes-devops-utils; View open source insights on deps.dev
Purl: pkg:npm/n8n-nodes-devops-utils

Affected ranges

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "2a0cabbca215340bdd2510d1321552ad4c2f0557fabceb3a30963a362d514d85",
            "tlsh": "2921427bc8635223d1c46e3974f5a42c121c28438cb0391d360b2a9926991688df919a"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-devops-utils-1.0.0.tgz",
            "hashes": {
                "sha1": "f527df25dc200e38a441d3626e261783f4cbe27c",
                "sha512_sri": "sha512-W+Ty5EuN0NkmA+2XTQVKGCDKWWKbcRj/CRY3M+hdcc75OdkCiP2QOzYcSOe9FiOiV7H6yjByEr+clox11u7UQg=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/n8n-nodes-devops-utils/MAL-2026-10775.json"