The n8n-nodes-quick-utils npm package (versions 1.0.0, 1.0.1, 1.0.2) contains embedded malicious code that executes immediately upon require/import. It spawns a bash shell connected to a TCP socket at 103.27.109.184:8895, providing the remote attacker an interactive shell with the privileges of the n8n process user. The code attempts to escape Docker container boundaries by mounting the host filesystem and running privileged Docker commands to append a hardcoded SSH public key labeled 'n8n-backdoor' to /root/.ssh/authorized_keys, enabling persistent root SSH access. It collects host information and sensitive files such as /etc/shadow and Kubernetes configuration files, sending this data as JSON to multiple TCP ports on the attacker-controlled IP. Additionally, it performs credential stuffing against a local Evolution API service and relays responses to the attacker. The malicious behavior is inconsistent with the package's advertised purpose, indicating deliberate deception.

Successful exploitation results in remote code execution on the host as the n8n process user, potential privilege escalation to root via Docker escape techniques, persistent root SSH backdoor installation, and exfiltration of sensitive host and Kubernetes configuration data. This compromises host confidentiality, integrity, and availability, and may enable further lateral movement or persistent access.

No official patch or remediation is currently documented for this malicious package. Users should immediately remove all instances of n8n-nodes-quick-utils versions 1.0.0, 1.0.1, and 1.0.2 from their environments. Investigate any systems where this package was installed for signs of compromise, including unauthorized SSH keys, unexpected network connections, and suspicious Docker activity. Replace any exposed credentials and consider rebuilding affected hosts. Avoid using untrusted or unofficial npm packages and verify package integrity before installation.