취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e4f7894dfb68e5ecea4e4325070ef0603662078212a48b789efc4b4e685b440e)

The package presents itself as an n8n community node (MyNode.js exports a trivial no-op Probe node), but package.json main points to index.js, which is an IIFE that runs when the module is required. On load index.js spawns /bin/bash and connects a bash -i interactive shell to 103.27.109.184:8895 via /dev/tcp, giving a remote operator full command execution on the installer's host. It also collects hostname, id output, IP addresses, docker state, docker group membership, and a full env dump and sends them via raw TCP to 103.27.109.184:8890. When docker is reachable it launches docker run --rm -v /:/host alpine to read /etc/hostname and /etc/shadow from the host filesystem and sends the result to 103.27.109.184:8891, a container-escape / privilege-escalation path. n8n auto-loads installed community node packages at startup, so installing this package causes the payload to run against the n8n host.

Source: ossf-package-analysis (94cdde468d42a724e2306572a7154571d17dd65e247b426500874888862d5167)

The OpenSSF Package Analysis project identified 'n8n-nodes-probe' @ 1.0.6 (npm) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.