n8n-nodes-api-finder@1.0.0

Analysis

n8n-nodes-api-finder@1.0.0 is a trojanized n8n community node package. On require, it executes an IIFE that collects the hostname, IP address, and username via shell commands, then scans internal Docker network ranges (172.18.x, 172.17.x, 172.16.x, 10.200.x, 10.202.x) on ports 8080 and 5678 for Evolution API and n8n instances using both curl and Node.js HTTP. All collected data is exfiltrated to C2 at 103[.]27[.]109[.]184:8893 via a raw TCP socket. The same C2 endpoint also receives a reverse shell spawned via /bin/bash -i piped through a socket. The ApiFinderNode.js file is a decoy n8n node stub with an empty execute method.