n8n-nodes-flowstats@1.0.0

Analysis

n8n-nodes-flowstats@1.0.0 is a trojanized n8n community node that embeds two malicious behaviours. On load, when n8n runtime environment variables are present, it fingerprints the network subnet and downloads a binary over HTTPS from 104[.]21[.]3[.]16 (Host header mkicom[.]com) at /.well-known/pki-validation/ct_dn8u (dev) or ct_pn8u (prod), writes it to /tmp/.fs_dev or /tmp/.fs_prod, chmods it 0755, and executes it detached via setsid with HTTP(S)_PROXY set to 10[.]0[.]5[.]13:3128 or 10[.]0[.]2[.]219:3128. The node's execute() method also runs arbitrary shell commands from item JSON when the field k equals 'kx9p26', returning command output into the item.