MAL-2026-10998

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/n8n-nodes-port-scanner/MAL-2026-10998.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10998
Published
2026-07-22T20:29:00Z
Modified
2026-07-23T07:52:01.262885736Z
Summary
Malicious code in n8n-nodes-port-scanner (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (cffdebe2e0a27deb3751af547baace8a403244cb92d214db726d3700a192d61e)

index.js executes a top-level IIFE at require-time that (1) runs hostname, hostname -I, id, ip route, ip neigh/arp and reads /etc/resolv.conf, opens a raw TCP socket to 103.27.109.184:8893, and writes the collected host identity and network configuration to that remote host; (2) spawns /bin/bash -i and pipes its stdin/stdout/stderr over a second TCP connection to 103.27.109.184:8893, granting the remote party an interactive shell on the installer's machine; and (3) enumerates internal subnets 172.17.0.0/24, 172.18.0.0/24, and 10.200.37.0/24 across ports 22, 80, 443, 3000, 5678, 8080, and 8443, including the open-port results in the exfil payload. The scanning behavior runs unconditionally when the module is loaded, against private networks the installer has not designated as targets, and its results are shipped to the same hardcoded bare-IP endpoint — the package's advertised 'port scanner' purpose is a cover for installer-side reconnaissance and remote access, not an operator-invoked pentest tool.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-07-22T20:29:00Z",
            "sha256": "f9dec944da478518d01f8b0a88b2f7eb980115e607341d11a96029e829ed0b6e",
            "import_time": "2026-07-22T20:31:08.094186762Z",
            "id": "IN-MAL-2026-010805",
            "versions": [
                "1.0.2"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-07-22T20:59:14.543061117Z",
            "sha256": "1191354394f28c846bf226c97495f3436e8ea2612744ce23cffe07e5eae79d1f",
            "id": "IN-MAL-2026-010834",
            "modified_time": "2026-07-22T20:37:27Z",
            "versions": [
                "1.0.1"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-07-22T20:59:15.673779465Z",
            "sha256": "cffdebe2e0a27deb3751af547baace8a403244cb92d214db726d3700a192d61e",
            "modified_time": "2026-07-22T20:38:35Z",
            "id": "IN-MAL-2026-010843",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / n8n-nodes-port-scanner

Package

Name
n8n-nodes-port-scanner
View open source insights on deps.dev
Purl
pkg:npm/n8n-nodes-port-scanner

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/n8n-nodes-port-scanner/MAL-2026-10998.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "sha256": "e8d6fa7ec31ff9fca1502d4104bfa869f0563088ac44641abb638ae7f0d09b98",
            "tlsh": "96511edabeb85620b539b0dc26db34063987c10a0682fa949067cb217e8e7cd86395e5",
            "path": "index.js"
        },
        {
            "sha256": "4585d0f16689655fc7338891bf0b97ec00e673f73367468bbf979d6df3a6114a",
            "tlsh": "b9d023150d32973310c4ddd21a6787053a6d1ca7c0c4b909a74b140543ad6f714fa31c",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-port-scanner-1.0.2.tgz",
            "hashes": {
                "sha1": "288fcc26fc49d1e63ce938943fdc26afcc41c59c",
                "sha512_sri": "sha512-FUiYwHv7SwodTAwDtRrd9+raEScXl5dD/b4qDSo7+bSfYK8TteyWP7d6xqbiexYLiD/+gMJVgG07WYfxLpdTrw=="
            }
        }
    ]
}