The 'n8n-nodes-devops-utils' npm package (versions 1.0.0 to 1.0.7) is malicious. It pretends to be a legitimate n8n community node but executes an attack chain immediately upon being required. The malicious code spawns a bash shell connected to a remote attacker-controlled TCP socket, providing an interactive reverse shell. If Docker is present, it runs privileged containers to append a hardcoded SSH key to the host's root authorized_keys file, enabling persistent root SSH access. It also collects host reconnaissance data and sensitive files including /etc/passwd, /etc/shadow, and Kubernetes config files, then exfiltrates this data to attacker servers. The package's advertised functionality is a cover for these malicious activities.

Successful installation and use of this package results in full host compromise, including remote code execution via reverse shell, persistent root access through SSH key injection, and theft of sensitive system and Kubernetes credentials. This compromises the confidentiality, integrity, and availability of the affected system and any Kubernetes clusters accessible from it.

No official patch or remediation is currently available. Users should immediately remove and avoid using the 'n8n-nodes-devops-utils' package versions 1.0.0 through 1.0.7. Verify system integrity and check for unauthorized SSH keys and suspicious Docker containers. Monitor for signs of compromise and consider rebuilding affected hosts if persistence is suspected. Check vendor advisories or trusted security sources for updates or fixes.