n8n-nodes-sysdiag2

{"schema_version":"1.7.4","id":"MAL-2026-16162","published":"2026-09-14T22:01:42Z","modified":"2026-09-15T16:21:13.417226825Z","summary":"Malicious code in n8n-nodes-sysdiag2 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7cde3a20bc24f39c8a55a9f700f50c39dd42cbbab51c57ddf9fbbb54307ee7a8)\nThe package advertises itself as an n8n community node for system diagnostics, but the shipped node module (dist/SysDiag.node.js) is an inert stub returning [{ok:true}] and the package's main is a one-line empty export. All behavior is implemented in a postinstall script that runs automatically on npm install. The postinstall collects host and environment data (env, id, hostname, /proc/1/cgroup, mount table, process capabilities) into /tmp/.be and posts it via wget --post-file to http://121.127.33.228:8443/env2 over plain HTTP. It also downloads http://121.127.33.228:8444/mn8n2 to /tmp/.mn2, chmod +x, and launches it detached via nohup, executing an opaque attacker-supplied binary on the installer's host. In parallel, it spawns a detached loop that connects nc to 121.127.33.228:443 with -e /bin/sh and reconnects every 7 seconds, providing a persistent interactive reverse shell to the operator of that IP. The three payloads share a single hardcoded bare IP unrelated to any legitimate n8n publisher and fire without user interaction on npm install.\n\n## Source: ossf-package-analysis (b77e4f7678fc2bc58ccaf452ce0a7ade1c3fc98c18b0af60350fd6c37343a990)\nThe OpenSSF Package Analysis project identified 'n8n-nodes-sysdiag2' @ 2.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"name":"n8n-nodes-sysdiag2","ecosystem":"npm"},"versions":["2.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"020693305bbdc27a95f650e82eab4ff0ae9f5e619fa4a2bdbd653eaecaadabd9","tlsh":"1601abf8feb48820319e85b5360d80a58d83ca7b09566e9540c78ef9260d68db21e9f1"},{"path":"package.json","sha256":"aaae4b5f2284adb5febe9cf4f6acaec20667148449fc59020deb4538c684a23b","tlsh":"eee026248c719b7720cc1a696c9bc145aa250dab8598fc28b2df00884b692755d7fb49"}],"package_integrity":[{"filename":"n8n-nodes-sysdiag2-2.0.0.tgz","hashes":{"sha1":"2a73ad4fb095b0a04a8201269566a5c3e56ac1b1","sha512_sri":"sha512-auAcDW1upwP9JRmVWvqhqkF/lbQlFi21klectGw27JVoKfLCu4ZNrx/LLSrRIoflpdH9+O0krNaGRxyuhtfv9g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-sysdiag2/v/2.0.0"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-09-14T22:16:57.958317554Z","modified_time":"2026-09-14T22:01:42Z","sha256":"b77e4f7678fc2bc58ccaf452ce0a7ade1c3fc98c18b0af60350fd6c37343a990","source":"ossf-package-analysis","versions":["2.0.0"]},{"id":"IN-MAL-2026-020051","import_time":"2026-09-15T16:19:14.359779131Z","modified_time":"2026-09-15T15:53:27Z","sha256":"7cde3a20bc24f39c8a55a9f700f50c39dd42cbbab51c57ddf9fbbb54307ee7a8","source":"amazon-inspector","versions":["2.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}