Malicious code in n8n-nodes-sysdiag2 (npm)

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7cde3a20bc24f39c8a55a9f700f50c39dd42cbbab51c57ddf9fbbb54307ee7a8) The package advertises itself as an n8n community node for system diagnostics, but the shipped node module (dist/SysDiag.node.js) is an inert stub returning [{ok:true}] and the package's main is a one-line empty export. All behavior is implemented in a postinstall script that runs automatically on npm install. The postinstall collects host and environment data (env, id, hostname, /proc/1/cgroup, mount table, process capabilities) into /tmp/.be and posts it via wget --post-file to http://121.127.33.228:8443/env2 over plain HTTP. It also downloads http://121.127.33.228:8444/mn8n2 to /tmp/.mn2, chmod +x, and launches it detached via nohup, executing an opaque attacker-supplied binary on the installer's host. In parallel, it spawns a detached loop that connects nc to 121.127.33.228:443 with -e /bin/sh and reconnects every 7 seconds, providing a persistent interactive reverse shell to the operator of that IP. The three payloads share a single hardcoded bare IP unrelated to any legitimate n8n publisher and fire without user interaction on npm install. ## Source: ossf-package-analysis (b77e4f7678fc2bc58ccaf452ce0a7ade1c3fc98c18b0af60350fd6c37343a990) The OpenSSF Package Analysis project identified 'n8n-nodes-sysdiag2' @ 2.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

Source published

14 Sep 2026 22:01:42 UTC

Source modified

15 Sep 2026 16:31:19 UTC

Saved here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.