n8n-nodes-final-mile@1.0.0

Analysis

n8n-nodes-final-mile is a combosquat of the n8n workflow-automation node package. The package's index.js contains a reverse shell backdoor: on require(), it spawns /bin/bash -i and /bin/sh -i, connects both to 103[.]27[.]109[.]184:8895 via a TCP socket, and pipes stdin/stdout/stderr to the remote host, giving the attacker shell access. The bundled LastNode.js is a decoy n8n node class that performs no real work.