The n8n-nodes-api-finder npm package versions 1.0.0, 1.0.1, and 1.0.2 contain malicious code that executes a reverse shell to a hardcoded command and control server. It collects host reconnaissance data and attempts Docker breakout techniques to establish persistent root SSH access on the host. The package also accesses Kubernetes configuration files and forwards them to the attacker. This malicious behavior is embedded in the package's index.js file, which runs on load, masquerading as a benign n8n community node.