n8n-nodes-moonlet-utils (npm) · Malicious Code
Affects n8n-nodes-moonlet-utilsSource GCVE Database
Malicious package : remove n8n-nodes-moonlet-utils and rotate any secrets on hosts that installed it.
Data as of 25 Sep 2026, 04:49 UTC
Malicious package
Published to npm · OSV MAL-2026-17177
What to do
Remove n8n-nodes-moonlet-utils from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmn8n-nodes-moonlet-utils | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f49ee5bcbcb7e8f1028de4021134fdbbc895e737700cf82a834fb26d3b23dd05) postinstall.js fetches an opaque binary from https://mkicom.com/.well-known/pki-validation/ct_dn8, writes it to /tmp/.nc, chmods it 0755, and launches it detached via `spawn('/bin/sh', ['-c', 'setsid ' + OUT + '... &'], {detached:true})`. The download URL is disguised under a `.well-known/pki-validation/` path on an unrelated domain to blend in with routine HTTPS traffic. index.js is an empty stub (`module.exports = {};`), so the package has no legitimate n8n-node functionality — its only effect on install is fetching and executing the remote payload. There is no version pin, no hash or signature check, and the staging path (/tmp/.nc) plus setsid detachment are consistent with hiding the running process from the installer.