n8n-nodes-http-probe@1.0.0

Analysis

n8n-nodes-http-probe@1.0.0 is a trojanized n8n community node. On require(), its index.js probes internal Docker networks (172[.]17[.]0[.]2, 172[.]17[.]0[.]1, 172[.]18[.]0[.]2) on ports 80, 443, and 8080, collects the hostname, and exfiltrates the results to 103[.]27[.]109[.]184:8893. It also spawns a reverse shell (/bin/bash -i) to the same IP and port. The HttpProbeNode.js file is a stub that performs no real work; the malicious behaviour runs from the package entry point.