n8n-nodes-devops-utils@1.0.0

DevOps utility nodes for n8n workflow automation

AI Security Review

scanned 1h ago · by lpm-firewall-ai

Installing the package automatically launches a concealed reverse-shell payload. It attempts several shell-capable network backdoors against the same remote endpoint.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation runs `postinstall`

Impact

Remote operator can obtain interactive shell command execution with the installing user's privileges.

Mechanism

base64-decoded Bash reverse-shell launcher

Attack narrative

The npm `postinstall` hook decodes an embedded Bash script and executes it in the background. That script tries Bash `/dev/tcp`, `python3`, `python`, and `nc` reverse-shell variants, each connecting to `103.27.109.184:8888` and attaching an interactive `/bin/sh` to the socket. This is unconsented install-time remote command execution, not package-aligned functionality.

Rationale

Direct source inspection confirms an obfuscated install-time reverse-shell payload with no legitimate implementation to justify it. The package is malicious and should be blocked.

Evidence

package.jsonindex.js

Network endpoints1

103.27.109.184:8888

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

n8n-nodes-devops-utils@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code