n8n-nodes-utils-helper@1.0.0

Analysis

n8n-nodes-utils-helper is a trojanized n8n community node package. On load, index.js runs extensive host reconnaissance: collects hostname, user identity, IP addresses, available tools (curl/wget/python3/python/nc/bash/sh/node), environment variables filtered for API keys, tokens, secrets, passwords, and database/container/n8n/WhatsApp credentials; checks for Docker socket access; fingerprints container cgroup and capabilities; scans the internal Docker bridge network (172[.]17[.]0[.]1 and 172[.]17[.]0[.]2) for open ports (22, 80, 443, 8080, 5678). All collected data is exfiltrated via TCP to 103[.]27[.]109[.]184:8893. The same C2 endpoint receives a reverse shell connection, giving the attacker interactive shell access to the compromised host.