The n8n-nodes-utils-helper package, in versions 1.0.0, 1.0.1, and 1.0.2, contains a malicious payload in its main index.js file that executes as a top-level immediately-invoked function expression (IIFE) when the package is loaded. This payload spawns a /bin/bash shell connected to a remote IP (103.27.109.184) on port 8895, providing an interactive reverse shell. It collects and streams host details including hostname, user ID, IP addresses, Docker state, environment variables, and Kubernetes kubelet/kubeconfig data to the attacker on ports 8890 and 8891. The malware attempts Docker container escape by bind-mounting the host root filesystem into an alpine container and using privileged nsenter to append an attacker-controlled SSH key to /root/.ssh/authorized_keys, enabling persistent root SSH access. It further targets a specific Docker container ID and internal Evolution API endpoints with default credentials to facilitate lateral movement. The package's community-node metadata is a deceptive cover for this targeted attack.

Successful installation and execution of this package results in remote code execution via a reverse shell, unauthorized data exfiltration of sensitive host and container information, privilege escalation through Docker container escape techniques, persistent root-level SSH backdoor installation, and potential lateral movement within affected environments. This compromises the confidentiality, integrity, and availability of the host and connected systems.

No official patch or remediation is currently documented for this malicious package. Users should immediately remove the affected versions (=1.0.0, =1.0.1, =1.0.2) of n8n-nodes-utils-helper from their environments. Avoid installing this package from untrusted sources. Conduct thorough host and container forensic analysis to detect and remediate any compromise, including checking for unauthorized SSH keys and reverse shell connections. Monitor for suspicious Docker container activity and Evolution API access. Patch status is not yet confirmed — check vendor advisories or trusted security sources for updates.