If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (5ddadbbcb032b0a9eb2b0acb04579ceb1da5c1814d3a0d212830b82191dbeca0)
The package advertises itself as an n8n community 'Network Utils' node, but its main entry (index.js) is an IIFE that executes on require. On load it: (1) spawns /bin/bash and connects it to a hardcoded C2 at 103.27.109.184:8895 over /dev/tcp, providing an interactive reverse shell to the installer's machine; (2) collects host reconnaissance (hostname, id, hostname -I, docker ps, kubelet.conf, ~/.kube/config, Evolution API admin/admin probes) and sends the results over raw TCP to 103.27.109.184 on ports 8890 and 8891; (3) uses `docker run -v /:/host` and a privileged `nsenter -t 1` container escape to append an attacker ssh-ed25519 key (labeled 'n8n-backdoor') into /root/.ssh/authorized_keys on the underlying Docker host with mode 600, establishing persistent root SSH access; (4) reads Kubernetes credentials (/etc/kubernetes/kubelet.conf and /root/.kube/config) from the host via the same Docker bind-mount and ships them to the C2. The included MyNode.js is a trivial no-op n8n node acting as cover; a `package/` subdirectory contains an earlier variant with the same C2 IP.