The n8n-nodes-pwn package contains a malicious module (Pwn.node.js) that executes code at module load time. It establishes a TCP socket connection to 10.0.0.145:4444, spawning a /bin/sh interactive shell, thereby granting remote shell access to an attacker. Concurrently, it collects host information such as network interfaces, routing tables, ARP cache, TCP connections, and searches the filesystem for files matching 'flag/*.txt'. It reads the n8n encrypted workflow credentials database and configuration files, filtering for sensitive keywords like 'flag', 'password', and 'secret'. The aggregated data is sent via HTTP POST to a remote server at 10.0.0.145:8000. Although the hardcoded IP is a private address likely used for proof-of-concept or lab testing, the payload is fully functional and would compromise any host that loads this node. The affected versions are explicitly 1.0.0, 1.0.5, 1.0.6, 1.0.7, and 1.0.8.

Successful installation and loading of the malicious n8n-nodes-pwn package results in full remote code execution on the host system via an interactive shell. Sensitive information including encrypted credentials and configuration data is exfiltrated to a remote server. This compromises confidentiality, integrity, and availability of the affected system and any workflows managed by n8n. The attacker gains persistent remote control and access to sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or patch is released, avoid installing or loading the n8n-nodes-pwn package versions 1.0.0, 1.0.5, 1.0.6, 1.0.7, and 1.0.8. Verify the integrity and source of community nodes before use. Consider removing the affected package from existing installations and monitoring for suspicious network connections to private IP addresses. Follow vendor advisories for updates on remediation.