The n8n-nodes-net-utils package, advertised as a community 'Network Utils' node for n8n, contains an immediately invoked function expression (IIFE) in its main entry point that executes upon require. This malicious code spawns a /bin/bash shell connected to a hardcoded C2 server at 103.27.109.184:8895, providing an interactive reverse shell. It collects host reconnaissance data including hostname, user ID, IP addresses, Docker and Kubernetes configuration files, and probes for Evolution API credentials, sending this data over raw TCP to the C2 on ports 8890 and 8891. It further attempts a Docker container escape using privileged nsenter to append an attacker SSH ed25519 key labeled 'n8n-backdoor' into /root/.ssh/authorized_keys on the Docker host, enabling persistent root SSH access. Kubernetes credentials are also exfiltrated via mounted host directories. The package contains a no-op node as a decoy and an earlier variant with the same C2 IP in a subdirectory. Affected versions are 1.0.0, 1.0.1, and 1.0.2.

This malicious package compromises the security of any system that installs it by providing attackers with an interactive reverse shell, enabling remote command execution. It exfiltrates sensitive host and Kubernetes configuration data, potentially exposing cluster credentials and infrastructure details. The attacker gains persistent root-level SSH access on Docker hosts through container escape and SSH key injection, allowing long-term unauthorized control. This can lead to full system compromise, data theft, and further lateral movement within affected environments.

No official patch or remediation guidance is currently available. Users should immediately uninstall the affected versions (=1.0.0, =1.0.1, =1.0.2) of the n8n-nodes-net-utils package and avoid using this package from untrusted sources. Conduct a thorough security audit of affected systems for signs of compromise, including unauthorized SSH keys, unexpected network connections to 103.27.109.184, and presence of the malicious package files. Rotate any exposed credentials, especially Kubernetes and SSH keys. Monitor for suspicious activity and consider rebuilding compromised hosts. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.