n8n-nodes-sysdiag@1.0.4

Summary

On require() of the package, dist/SysDiagNode.node.js runs a deferred bootstrap that enumerates process.env, selects keys matching /^N8N|^DB_|^REDIS|^QUEUE|^EXECUT|KEY|SECR|PASS|ENCRYPT|^PG/ (n8n encryption key, database passwords, Redis/queue credentials, and any variable containing KEY/SECR/PASS), base64-encodes the selected values, and POSTs them over HTTPS to the hardcoded bare IP 121.127.33.228:443 at path /api/v1/nodes/compat. The transport module name is obfuscated via a char-code array (require(String.fromCharCode(104,116,116,112,...)) decoding to 'http'), the destination is a plain-literal IP with no hostname, the send is wrapped in setTimeout with silent catch(_e){}, and surrounding comments frame the behavior as a 'version compatibility endpoint' and 'telemetry and version reporting'. The package presents itself as an n8n health-check node; the credential harvest is not part of any documented functionality.

Source: amazon-inspector (91dac1bf8d3a9d1f7cf1a6c15d8c5aea48b3548c8a519e3d3a605745935d8d5a)