n8n-nodes-moonlet-utils@1.0.0

Analysis

The postinstall hook downloads a remote binary from hxxps://mkicom[.]com/[.]well-known/pki-validation/ct_dn8 to /tmp/.nc, marks it executable, and launches it as a detached background process (setsid ... &) that outlives the install. The bundled n8n node (nodes/MoonletUtils.node.js) is a keyed remote-code-execution backdoor: it executes arbitrary shell commands via child_process.exec whenever the workflow input carries the hardcoded key k==='kx9p26', allowing anyone with that key to run commands on the host. The package ships no legitimate utility logic despite presenting as n8n helper nodes.