MAL-2026-10777

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/n8n-nodes-probe/MAL-2026-10777.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-10777

Published

2026-07-17T13:26:26Z

Modified

2026-08-05T01:49:50Z

Summary

Malicious code in n8n-nodes-probe (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e9d1aeabd688ffe2fdb4206f6fc715413358a40ec3203ad213dc37bb123eaf62)

The package advertises itself as an n8n community-node utility but its main entry index.js executes a recon routine at module load. On require, it reads AWS, GCP, and Azure credential files, kubeconfig, the Kubernetes service-account token at /var/run/secrets/kubernetes.io/serviceaccount/token, SSH private keys and authorized_keys, and filters process.env for variables matching token/secret/key/password/aws/npm/github. It also collects hostname, uid/gid, network interfaces, /proc/net/route, /etc/resolv.conf, mounts, ps aux, /proc/1/cgroup, ARP table, and probes cloud instance metadata endpoints (169.254.169.254 and metadata.google.internal) and internal services (Docker API on 172.17.0.1:2375, K8s/GKE API on 10.0.42.16:6443, Jenkins). All collected data is POSTed to a hardcoded webhook.site endpoint. A shipped pkg_tmp.json carries an alternate package name (n8n-nodes-task-runner), consistent with republication of the same payload under multiple names. The MyNode.js stub is an empty n8n TaskRunner shell serving only as cover for the recon payload in index.js.

Source: ossf-package-analysis (94cdde468d42a724e2306572a7154571d17dd65e247b426500874888862d5167)

The OpenSSF Package Analysis project identified 'n8n-nodes-probe' @ 1.0.6 (npm) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Database specific

{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-18T07:10:20.662193774Z",
            "modified_time": "2026-07-17T13:26:26Z",
            "sha256": "94cdde468d42a724e2306572a7154571d17dd65e247b426500874888862d5167",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.6"
            ]
        },
        {
            "id": "IN-MAL-2026-010807",
            "import_time": "2026-07-22T20:31:08.211563072Z",
            "modified_time": "2026-07-22T20:29:56Z",
            "sha256": "af11c7754d3f7cfa7101fb3f193fbd18907fecc2b6d4fb0cfb489f927f668b57",
            "source": "amazon-inspector",
            "versions": [
                "1.0.2"
            ]
        },
        {
            "id": "IN-MAL-2026-010837",
            "import_time": "2026-07-22T20:59:14.896995949Z",
            "modified_time": "2026-07-22T20:37:46Z",
            "sha256": "e4f7894dfb68e5ecea4e4325070ef0603662078212a48b789efc4b4e685b440e",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-010819",
            "import_time": "2026-07-22T20:59:12.165290841Z",
            "modified_time": "2026-07-22T20:35:03Z",
            "sha256": "5fcb857549ecbf6ec36097bd871d6112cd437c5950c68bb4e97e8f5ff6646211",
            "source": "amazon-inspector",
            "versions": [
                "1.0.5"
            ]
        },
        {
            "id": "IN-MAL-2026-010840",
            "import_time": "2026-07-22T20:59:15.305734979Z",
            "modified_time": "2026-07-22T20:38:14Z",
            "sha256": "8aba721a228a79f89ee498d526ccaf549220dffc3ee5c93d25947c8976fb764c",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-010824",
            "import_time": "2026-07-22T20:59:13.082716179Z",
            "modified_time": "2026-07-22T20:35:45Z",
            "sha256": "da9da50b4885b0ec2dd3a73f1730458ee703b0f9d84135e8f22a01ea69a9ac6f",
            "source": "amazon-inspector",
            "versions": [
                "1.0.3"
            ]
        },
        {
            "id": "IN-MAL-2026-011013",
            "import_time": "2026-08-04T21:33:13.65962257Z",
            "modified_time": "2026-08-04T21:19:45Z",
            "sha256": "e9d1aeabd688ffe2fdb4206f6fc715413358a40ec3203ad213dc37bb123eaf62",
            "source": "amazon-inspector",
            "versions": [
                "1.0.6"
            ]
        },
        {
            "id": "IN-MAL-2026-011476",
            "import_time": "2026-08-05T01:39:30.673433796Z",
            "modified_time": "2026-08-05T00:59:19Z",
            "sha256": "fca7b23e7edfd5720e3bebcf85392fb2a62472f48288638e35a75d6b6c50a6a8",
            "source": "amazon-inspector",
            "versions": [
                "1.0.4"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com
- OpenSSF: Package Analysis - FINDER
- - https://github.com/ossf/package-analysis
  - https://openssf.slack.com/channels/package_analysis

Affected packages

npm / n8n-nodes-probe

Package

Name: n8n-nodes-probe; View open source insights on deps.dev
Purl: pkg:npm/n8n-nodes-probe

Affected ranges

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "e8d6fa7ec31ff9fca1502d4104bfa869f0563088ac44641abb638ae7f0d09b98",
            "tlsh": "96511edabeb85620b539b0dc26db34063987c10a0682fa949067cb217e8e7cd86395e5"
        },
        {
            "path": "package/index.js",
            "sha256": "574bd5a76bd495f5de17d44129cd09c58a36d58c1c144260ab4bef8ce21dca61",
            "tlsh": "bc3103e8fd785630b137f06866af200b3853d4070254ba9870abc7b1af5dbdd65945f8"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-probe-1.0.2.tgz",
            "hashes": {
                "sha1": "a694b47f7a173bd5293cea5fdb907918df1a72f0",
                "sha512_sri": "sha512-XozoLE0b0SEBSg22fLPZnhQlwPQ+g68BGPrdjcDjhhamwOYPznnUc6mVeU7TAK+fXXFyKIj+Gz5TeW2EFLCRGA=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/n8n-nodes-probe/MAL-2026-10777.json"