The n8n-nodes-port-scanner package includes a top-level immediately-invoked function expression (IIFE) that runs at require-time. This code executes system commands to gather hostname, IP addresses, routing, ARP/neighbors, and DNS resolver information, then sends this data to a remote host at 103.27.109.184:8893. It also spawns an interactive bash shell connected over TCP to the same remote host, granting full remote shell access. Additionally, it scans internal subnets 172.17.0.0/24, 172.18.0.0/24, and 10.200.37.0/24 on multiple common ports, including the scan results in the exfiltrated data. This behavior occurs unconditionally when the module is loaded, without operator invocation, indicating the package is a malicious backdoor and reconnaissance tool rather than a legitimate port scanner.

Systems that install and load any of the affected versions of this package are subject to unauthorized data exfiltration of host and network information, remote command execution via an interactive shell by a remote attacker, and internal network reconnaissance. This compromises confidentiality, integrity, and potentially availability of the affected host and its internal network environment.

No official patch or remediation is currently available for this malicious package. Users should immediately remove and avoid using n8n-nodes-port-scanner versions 1.0.0, 1.0.1, and 1.0.2. Verify that no unauthorized remote connections or shells remain active. Audit systems for signs of compromise and network scanning activity related to this package. Consider blocking outbound connections to the hardcoded IP 103.27.109.184:8893 at network perimeter controls. Monitor for any further updates from the package maintainers or security advisories.