The n8n-nodes-pwn package contains a malicious module (Pwn.node.js) that executes code at module load time. It opens a TCP connection to 10.0.0.145:4444 and pipes this socket to a spawned /bin/sh interactive shell, granting remote shell access to an attacker. Concurrently, it runs reconnaissance commands to gather network and system information, reads sensitive files such as /home/node/.n8n/database.sqlite filtering for secrets, and reads configuration files. The collected data is sent via HTTP POST to a remote server at 10.0.0.145:8000. The hardcoded IP is a private address consistent with a lab or proof-of-concept environment, but the payload is fully functional and would compromise any host that loads this node.

Successful loading of the malicious n8n-nodes-pwn package results in complete remote code execution with interactive shell access on the host. Sensitive information including encrypted credentials and configuration data is exfiltrated. This compromises confidentiality, integrity, and availability of the affected system and any workflows managed by n8n on that host.

No official patch or remediation is currently documented. Users should immediately cease using the affected versions of the n8n-nodes-pwn package (1.0.0, 1.0.5, 1.0.6, 1.0.7, 1.0.8). Remove the malicious package from all environments and avoid loading this community node until a trusted, verified version is available. Monitor for unauthorized network connections and investigate any systems where this package was installed. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates on remediation.