n8n-nodes-moonlet-helpers (npm) · Malicious Code
Affects n8n-nodes-moonlet-helpersSource GCVE Database
Malicious package : remove n8n-nodes-moonlet-helpers and rotate any secrets on hosts that installed it.
Data as of 25 Sep 2026, 04:49 UTC
Malicious package
Published to npm · OSV MAL-2026-17176
What to do
Remove n8n-nodes-moonlet-helpers from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmn8n-nodes-moonlet-helpers | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (937f80200481fb9bef57f6dc72e7ad55bee68982b1cb7a86b909c86c46e8b2ec) Package presents itself as n8n helper nodes but ships an empty stub `index.js` (`module.exports = {}`) and no functional node modules. On `npm install`, `postinstall.js` runs automatically: it performs an HTTPS GET to `https://mkicom.com/.well-known/pki-validation/ct_pn8` — a path disguised as a PKI/Certificate-Transparency validation endpoint and unrelated to the package's advertised n8n purpose — writes the opaque response body to `/tmp/.np`, chmods it 0755, and executes it via `spawn('/bin/sh', ['-c', 'setsid /tmp/.np... &'], {detached: true})` so the process survives npm exit. There is no hash, signature, or version pinning on the downloaded bytes. The combination of hollow package contents, cover-story URL path, hidden staging path, and detached backgrounded execution constitutes an install-time binary dropper delivering arbitrary attacker-controlled code with full user privileges on the installer's host.