The malicious n8n-nodes-task-runner package disguises itself as a legitimate n8n community node by including a no-op stub node. However, its main module runs a recon() function immediately when required. This function reads sensitive credential files from AWS, Google Cloud, Azure, Kubernetes, and SSH configurations, enumerates environment variables containing secrets, and executes system commands to gather system and network information. It also probes cloud instance metadata services and scans internal network endpoints including Docker and Kubernetes APIs. The aggregated reconnaissance data is sent as JSON to a hardcoded external collector URL at webhook.site. This package thus acts as a credential stealer and internal network reconnaissance tool.

This malicious package can lead to the theft of cloud credentials, SSH keys, and other sensitive secrets from compromised systems. It also gathers detailed internal network and system information, potentially enabling further attacks or lateral movement. The exfiltration of this data to an external server compromises confidentiality and security of the affected environment.

No official patch or remediation is currently available for this malicious package. Users should immediately remove any installations of n8n-nodes-task-runner versions =1.0.0 through =1.0.16. Avoid installing packages from untrusted sources and verify package authenticity before use. Monitor for any signs of credential compromise and rotate affected credentials. Since this is a malicious package impersonating a legitimate node, do not rely on the package's own code for mitigation.