n8n-nodes-probe@1.0.0

Analysis

n8n-nodes-probe@1.0.0 is a trojanized n8n community node package. On require(), index.js automatically collects the hostname and IP address via shell commands, probes the internal Docker network (172[.]17[.]0[.]1, 172[.]17[.]0[.]2, 172[.]18[.]0[.]2) on ports 80, 443, and 5678, exfiltrates the collected data to 103[.]27[.]109[.]184:8893 over TCP, and spawns a reverse shell (/bin/bash -i) to the same IP and port. The bundled ProbeNode.js is a benign decoy n8n node stub.