n8n-nodes-sysdiag

{"modified":"2026-09-14T17:17:17Z","published":"2026-09-14T16:45:49Z","schema_version":"1.7.4","id":"MAL-2026-16147","summary":"Malicious code in n8n-nodes-sysdiag (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (91dac1bf8d3a9d1f7cf1a6c15d8c5aea48b3548c8a519e3d3a605745935d8d5a)\nOn require() of the package, dist/SysDiagNode.node.js runs a deferred bootstrap that enumerates process.env, selects keys matching /^N8N|^DB_|^REDIS|^QUEUE|^EXECUT|KEY|SECR|PASS|ENCRYPT|^PG/ (n8n encryption key, database passwords, Redis/queue credentials, and any variable containing KEY/SECR/PASS), base64-encodes the selected values, and POSTs them over HTTPS to the hardcoded bare IP 121.127.33.228:443 at path /api/v1/nodes/compat. The transport module name is obfuscated via a char-code array (`require(String.fromCharCode(104,116,116,112,...))` decoding to 'http'), the destination is a plain-literal IP with no hostname, the send is wrapped in setTimeout with silent catch(_e){}, and surrounding comments frame the behavior as a 'version compatibility endpoint' and 'telemetry and version reporting'. The package presents itself as an n8n health-check node; the credential harvest is not part of any documented functionality.\n","affected":[{"package":{"ecosystem":"npm","name":"n8n-nodes-sysdiag"},"versions":["1.0.1","1.0.0","1.0.2","1.0.4","1.0.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/SysDiagNode.node.js","sha256":"f7a11bebf33903d5541cfca1f4ff37b1196e4e826e1d8ba3ef289d9bad58d70e","tlsh":"d25120a94ab691521572b1821b5b600262b593077918fcbabbcc231d2f0e82cc1f27dd"}],"package_integrity":[{"filename":"n8n-nodes-sysdiag-1.0.1.tgz","hashes":{"sha1":"262ec9b503d9b409c6aff7c520d83bc06ba198fb","sha512_sri":"sha512-8ZqePP/GN8o8VPrPJbHg/uwtgu1aTFTU/uWnN+mhuWMERmMfoiFtSb5aecffA+CJs6dWHSVx5AGhvtHmfgan+Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-sysdiag/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-sysdiag/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-sysdiag/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-sysdiag/v/1.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-sysdiag/v/1.0.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020028","import_time":"2026-09-14T17:15:21.069814053Z","modified_time":"2026-09-14T16:45:49Z","sha256":"2902b0bf06d599569fe0bf596e4bbf0014cfab3b98e00f2e529ae01626e34238","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-020029","import_time":"2026-09-14T17:15:21.183956387Z","modified_time":"2026-09-14T16:45:56Z","sha256":"91dac1bf8d3a9d1f7cf1a6c15d8c5aea48b3548c8a519e3d3a605745935d8d5a","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-020032","import_time":"2026-09-14T17:15:21.457249112Z","modified_time":"2026-09-14T16:46:18Z","sha256":"977409e61123cba2eefd6c2a9baa24ada46514082c3ca57a1ef26595d5fe6095","source":"amazon-inspector","versions":["1.0.2"]},{"id":"IN-MAL-2026-020030","import_time":"2026-09-14T17:15:21.331990168Z","modified_time":"2026-09-14T16:46:03Z","sha256":"c2878ba19f2514a4c0c553948978001ceb7fe70402173437051eaffe0e6f2228","source":"amazon-inspector","versions":["1.0.4"]},{"id":"IN-MAL-2026-020031","import_time":"2026-09-14T17:15:21.399235887Z","modified_time":"2026-09-14T16:46:10Z","sha256":"fb7cc515edb8a403b549dce802d6cd24f6a2eb54fa665890e4f050cc2a7ae1a4","source":"amazon-inspector","versions":["1.0.3"]}]}}