MAL-2026-11005

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/n8n-nodes-quick-utils/MAL-2026-11005.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11005
Published
2026-07-22T20:32:15Z
Modified
2026-07-23T07:52:01.964692309Z
Summary
Malicious code in n8n-nodes-quick-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1a3ad37cc152517b09b8ee72a009a179399ddf802e7f22c126c9d104b4252d5a)

On require/import, index.js spawns /bin/bash wired to a TCP socket at hardcoded IP 103.27.109.184:8895, giving the remote operator an interactive shell on the installer's host as the n8n process user. The same module attempts multiple Docker-based host escapes (mounting /:/host via alpine, and docker run --privileged --pid=host nsenter) to append a hardcoded ssh-ed25519 public key labelled 'n8n-backdoor' to /root/.ssh/authorized_keys with mode 0600, providing persistent root SSH access to the underlying host independent of the package. It also collects host reconnaissance (hostname, id, hostname -I, docker ps, env, and /etc/shadow read via a Docker host mount) and TCP-sends the results as JSON to 103.27.109.184:8890 and:8891. Additional code reads /host/etc/kubernetes/kubelet.conf and /host/root/.kube/config through the Docker mount and forwards their contents to the same C2, and execs into a specific local container to credential-stuff admin@admin.com/admin against the Evolution API at http://localhost:8080/manager/auth/login and http://172.18.0.2:8080/manager/auth/login, relaying the response to the C2. The package name and description advertise generic n8n utility nodes; none of the observed behavior corresponds to that stated purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010825",
            "sha256": "1a3ad37cc152517b09b8ee72a009a179399ddf802e7f22c126c9d104b4252d5a",
            "import_time": "2026-07-22T20:59:13.232280758Z",
            "modified_time": "2026-07-22T20:35:58Z",
            "versions": [
                "1.0.2"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-010842",
            "sha256": "ef60cde3bd5f967ec607360d49ba75951f13a4bb7e0fd33dd10f3fcd6b518e07",
            "import_time": "2026-07-22T20:59:15.546546088Z",
            "modified_time": "2026-07-22T20:38:28Z",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-010810",
            "sha256": "9c1e1f60ab1572824797a5a46ba3ec4c282dcbdc827c08da1867098a24c9246a",
            "modified_time": "2026-07-22T20:32:15Z",
            "import_time": "2026-07-22T20:59:11.07442827Z",
            "versions": [
                "1.0.1"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / n8n-nodes-quick-utils

Package

Name
n8n-nodes-quick-utils
View open source insights on deps.dev
Purl
pkg:npm/n8n-nodes-quick-utils

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/n8n-nodes-quick-utils/MAL-2026-11005.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "sha256": "e8d6fa7ec31ff9fca1502d4104bfa869f0563088ac44641abb638ae7f0d09b98",
            "tlsh": "96511edabeb85620b539b0dc26db34063987c10a0682fa949067cb217e8e7cd86395e5",
            "path": "index.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-quick-utils-1.0.2.tgz",
            "hashes": {
                "sha1": "d4b1e5dfcb512782944c89c78c6d272930bc9aab",
                "sha512_sri": "sha512-+xCFKCy2tBd2pEZRbbWabrHTtl1t34iLzBRERNN0UTD2X5abguYJrkQ1uzS8jGr4SpIikr/IDz3h3akYyv6T3w=="
            }
        }
    ]
}