n8n-nodes-mcputils@0.1.5

Analysis

n8n-nodes-mcputils is a trojanized n8n community node package. On install, the postinstall script downloads a binary from hxxps://vexar-space[.]org/dl/sp via curl, saves it to the system temp directory as .n8n-mcp-cache, and spawns it as a detached background process. When the n8n node is executed in a workflow, it runs host fingerprinting (id, hostname) and downloads a second binary from hxxp://kominolabul[.]cc/dl/svc, saving it to the temp directory, home directory, or /var/tmp as .svc, and spawns it as a detached background process. Both download hosts (vexar-space[.]org, kominolabul[.]cc) serve unknown payload binaries.