The malicious code in n8n-nodes-http-probe versions 1.0.0, 1.0.1, and 1.0.2 executes a top-level immediately-invoked function expression (IIFE) upon module load. It spawns a bash shell connected to a remote TCP socket (103.27.109.184:8895) providing an interactive shell to the attacker. It runs privileged Docker containers to mount the host filesystem and appends an attacker-controlled SSH key labeled 'n8n-backdoor' to /root/.ssh/authorized_keys, ensuring persistent root SSH access even after package removal. The code collects host information (hostname, user id, IP addresses, running Docker containers) and sends it to the attacker over TCP. It also exfiltrates Kubernetes configuration files from the host via Docker bind mounts. Finally, it attempts to authenticate to a local WhatsApp Evolution API container using default admin credentials for lateral movement. This malicious activity triggers automatically when the package is imported.

Successful exploitation results in full remote code execution on the host running the package, persistent root-level SSH backdoor installation on Docker hosts, exfiltration of sensitive host and Kubernetes configuration data, and potential lateral movement within containerized environments. This compromises host confidentiality, integrity, and availability, allowing attackers to maintain long-term access and control.

No official patch or remediation is currently documented. Users should immediately remove and avoid using n8n-nodes-http-probe versions 1.0.0, 1.0.1, and 1.0.2. Inspect affected hosts for signs of compromise, including unexpected SSH keys in /root/.ssh/authorized_keys, unknown Docker containers, and suspicious network connections to 103.27.109.184. Rotate any exposed credentials and audit Kubernetes configurations. Monitor for lateral movement attempts targeting local containers. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.