🛡️ MAL-2026-10999 — n8n-nodes-task-runner

Malicious code in n8n-nodes-task-runner (npm)

Source: amazon-inspector

The package impersonates the n8n task-runner subsystem but its shipped n8n node (MyNode.js) is a no-op stub whose execute() returns [[]]. The real payload lives in index.js (the package main), which runs a recon() function on module load. recon() reads ~/.aws/credentials, ~/.config/gcloud/application_default_credentials.json, ~/.azure/accessTokens.json, kubeconfig files, the Kubernetes service-account token, ~/.ssh/id_* and authorized_keys, and environment variables matching token/key/secret/pass/auth/aws/gcp/azure/npm/github/gitlab. It also shells out via curl and child_process to run id, ps aux, and read /proc/mounts, /proc/net/route, /etc/resolv.conf, /proc/1/cgroup, and arp; probes cloud instance-metadata services at 169.254.169.254 and metadata.google.internal; TCP-scans internal targets including the Docker API at 172.17.0.1:2375, an internal GKE API at 10.0.42.16:6443, Jenkins, and Kubernetes API endpoints; and enumerates /var/run/docker.sock. The aggregated JSON is POSTed to a hardcoded webhook.site collector at https://webhook.site/31b8dedb-f324-475f-8ffa-2b84878f4961. The n8n node stub exists only to make the package look like a legitimate community node while the credential stealer executes at require time.