The n8n-nodes-rce-poc package, when required by n8n, executes shell commands via execSync using the /bin/sh shell. The command executed is controlled by the environment variable __N8N_RCE_CMD, defaulting to a command that leaks host identity. Additionally, if __N8N_RCE_CB is set and EXEC_MODE is 'webhook' or 'both', the output of the command is serialized and sent via HTTP POST to the specified callback URL, enabling data exfiltration. The package exposes an execute() method that allows arbitrary shell command execution on the host, bypassing the n8n workflow sandbox. The package is self-identified as a proof-of-concept for remote code execution and has no legitimate use, effectively providing a drop-in RCE backdoor.

Any system with this package installed is fully compromised, as it allows arbitrary command execution on the host and exfiltration of command output to attacker-controlled endpoints. All secrets and keys on the compromised system should be considered exposed and require immediate rotation. The presence of this package breaks the security model of n8n workflows and can lead to complete system takeover.

Remove the n8n-nodes-rce-poc package immediately from any affected system. Rotate all secrets and keys that were stored or accessible on the compromised host from a secure, unaffected system. Because the package grants full control to an attacker, assume the system is fully compromised and consider rebuilding or thoroughly auditing the host. There is no official patch or fix for this package as it is malicious by design.