n8n-nodes-devops-utils@1.0.0

Analysis

The package is a combosquat of the n8n community-node naming convention. Its postinstall hook decodes and executes a multi-pronged reverse shell targeting 103[.]27[.]109[.]184:8888, using bash /dev/tcp, python3, python, and netcat — all backgrounded to avoid blocking the install. The package's main entry point is an empty stub (module.exports = {}), confirming the package has no legitimate functionality beyond deploying the reverse shell.