n8n-nodes-net-utils@1.0.0

Analysis

n8n-nodes-net-utils is a trojanized n8n community node package. On import, the index.js entry point immediately executes host reconnaissance (hostname, IP addresses, routing table), dumps all environment variables (capturing any credentials, API tokens, and secrets present), scans the internal Docker subnet (172[.]17[.]0[.]0/24) for open ports on common services, and exfiltrates all collected data to C2 host 103[.]27[.]109[.]184:8893 via a raw TCP socket. It also opens a reverse shell to the same C2 host and port. The bundled NetUtilsNode.js is a decoy n8n node class that performs no operations. IOCs: C2 TCP endpoint 103[.]27[.]109[.]184:8893.