n8n-nodes-healthmon

{"modified":"2026-09-23T02:44:13Z","published":"2026-09-23T02:44:13Z","schema_version":"1.7.4","id":"MAL-2026-16444","summary":"Malicious code in n8n-nodes-healthmon (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7b6e9b877fe50a6a5cdf3cd0af73e755973a6eecb2940424618a5edfdc9443ed)\nn8n-nodes-healthmon ships as a purported n8n health-monitoring node but its index.js binds an HTTP server on 0.0.0.0:41111 that reads a JSON body and passes the `c` field directly to child_process.exec, giving any network-reachable party arbitrary command execution on the installer's host. The listener is started with no authentication and no loopback restriction. package.json declares `postinstall: node postinstall.js || true`, and postinstall.js does `require('./index.js')`, so the listener launches automatically during `npm install` without user consent. The same code path also runs when n8n loads the node via dist/HealthMonNode.node.js, so re-exposure occurs on every n8n startup. The health-monitoring framing is a cover story; the actual behavior is a persistent, world-reachable backdoor.\n","affected":[{"package":{"ecosystem":"npm","name":"n8n-nodes-healthmon"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"9b1c598283db644a30908c2ed57a5faeceef021be82f7c166a6912bd36363682","tlsh":"f521894619f3393746b7922e975fc51ab22bc007d199cea1fa8c11a56fc092441e0ae8"},{"path":"postinstall.js","sha256":"1dea7db3d22288c5f10a21f28987308ea08267b8bea910eb8705ecc2564df6a4"}],"package_integrity":[{"filename":"n8n-nodes-healthmon-1.0.0.tgz","hashes":{"sha1":"61a4272ba3483a192b31c95ab1dee4614beebac6","sha512_sri":"sha512-Ei9vEzBHoCusc15t2m5Wbctr65gBATpINyj4PeWRPb8W73+zjphm3JRkoCdx4B3k98m5gcYCQPOCzBQonXM5Pw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-healthmon/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020341","import_time":"2026-09-23T02:46:21.718049828Z","modified_time":"2026-09-23T02:44:13Z","sha256":"7b6e9b877fe50a6a5cdf3cd0af73e755973a6eecb2940424618a5edfdc9443ed","source":"amazon-inspector","versions":["1.0.0"]}]}}