Malicious code in n8n-nodes-healthmon (npm)

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7b6e9b877fe50a6a5cdf3cd0af73e755973a6eecb2940424618a5edfdc9443ed) n8n-nodes-healthmon ships as a purported n8n health-monitoring node but its index.js binds an HTTP server on 0.0.0.0:41111 that reads a JSON body and passes the `c` field directly to child_process.exec, giving any network-reachable party arbitrary command execution on the installer's host. The listener is started with no authentication and no loopback restriction. package.json declares `postinstall: node postinstall.js || true`, and postinstall.js does `require('./index.js')`, so the listener launches automatically during `npm install` without user consent. The same code path also runs when n8n loads the node via dist/HealthMonNode.node.js, so re-exposure occurs on every n8n startup. The health-monitoring framing is a cover story; the actual behavior is a persistent, world-reachable backdoor.

Source published

23 Sep 2026 02:44:13 UTC

Source modified

23 Sep 2026 03:00:06 UTC

Saved here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.