The n8n-nodes-probe package masquerades as a benign n8n community node but contains an immediately invoked function expression (IIFE) in index.js that runs on require. This payload opens a reverse interactive bash shell to 103.27.109.184:8895, granting remote command execution. It exfiltrates hostname, user identity, IP addresses, Docker status, group memberships, and environment variables via raw TCP to the attacker's server. If Docker is accessible, it runs a container with host filesystem mounts to read sensitive files like /etc/hostname and /etc/shadow, sending these to the attacker, enabling container escape and privilege escalation. Because n8n auto-loads community nodes at startup, the malicious code executes automatically on the host.

Successful installation and loading of any affected n8n-nodes-probe version results in remote code execution on the host system, data exfiltration of sensitive environment and system information, and potential container escape and privilege escalation via Docker. This compromises the confidentiality, integrity, and availability of the affected host.

No official patch or remediation is currently documented. Users should immediately uninstall the n8n-nodes-probe package versions 1.0.0 through 1.0.6 and avoid installing or loading this package. Monitor for any unauthorized network connections to the indicated IP addresses. Check vendor advisories or trusted security sources for updates or official fixes. Consider restricting network egress and Docker permissions to limit potential exploitation.