n8n-nodes-pentest-rce@1.0.1

Analysis

Package n8n-nodes-pentest-rce@1.0.1 ships a postinstall script performing aggressive host reconnaissance: reads kubernetes service account token from /var/run/secrets/kubernetes[.]io/serviceaccount/token, dumps env vars (harvesting NPM_TOKEN, GITHUB_TOKEN, etc.), fingerprints host (hostname, uname, /etc/os-release), checks container capabilities and seccomp (sandbox escape feasibility), and enumerates mounts, ip config, /proc/1/cgroup and /proc/1/status. Output is delimited with =RCE_START= / =RCE_END= markers for easy scraping from npm install logs. The n8n node code is a stub that does nothing (PentestNode.node.js just passes input through). The actual product is the postinstall recon — a credential-harvesting and environment-fingerprinting payload. Not benign research: K8s SA token is a real credential, environment dump captures all tokens. No verifiable repo/program reference.