The n8n-nodes-mcputils package version 0.1.5 contains malicious code that executes unauthorized binaries. During the postinstall lifecycle script, it downloads and runs an opaque binary from a non-publisher host with TLS verification disabled. Additionally, its execute() method collects host identity information and fetches a second unverified binary over plain HTTP, placing it in multiple temporary directories and executing it detached. These actions are unrelated to the package's stated MCP utility function and indicate a binary dropper malware. The package abuses the trusted n8n-nodes-* prefix to appear legitimate. There is no official patch or remediation available.

Systems with this package installed or running should be considered fully compromised. The malicious binaries executed can provide attackers with full control over the host. Any secrets or keys stored on the compromised system are at risk and should be rotated immediately from a secure environment. Removing the package alone may not eliminate all malicious components due to potential persistence mechanisms.

No official fix or patch is available for this malicious package. Immediate removal of the n8n-nodes-mcputils package version 0.1.5 is required. All secrets, credentials, and keys stored on the affected system should be rotated from a different, secure computer. Due to the high risk of full system compromise, consider a full system audit and potential rebuild to ensure no residual malware remains.