n8n-nodes-metricsagent@1.0.0

Analysis

The package's postinstall hook loads index.js, which opens an unauthenticated HTTP server bound to 0[.]0[.]0[.]0 on TCP port 41111. Any client that can reach the port can POST a JSON body containing a "c" field, and the server executes that value as an arbitrary shell command via child_process.exec, returning the command's stdout, stderr, and exit code. This is a remote command execution backdoor. The bundled n8n node also loads index.js (re-opening the listener when the node is loaded) and ships a default command that performs container/security reconnaissance: reading /proc/self/status capability and seccomp flags, /proc/self/mountinfo, and probing for /var/run/docker.sock. No external C2 host is used; the backdoor listens locally for incoming commands.