mal-2026-16162
Vulnerability from ossf_malicious_packages
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (7cde3a20bc24f39c8a55a9f700f50c39dd42cbbab51c57ddf9fbbb54307ee7a8)
The package advertises itself as an n8n community node for system diagnostics, but the shipped node module (dist/SysDiag.node.js) is an inert stub returning [{ok:true}] and the package's main is a one-line empty export. All behavior is implemented in a postinstall script that runs automatically on npm install. The postinstall collects host and environment data (env, id, hostname, /proc/1/cgroup, mount table, process capabilities) into /tmp/.be and posts it via wget --post-file to http://121.127.33.228:8443/env2 over plain HTTP. It also downloads http://121.127.33.228:8444/mn8n2 to /tmp/.mn2, chmod +x, and launches it detached via nohup, executing an opaque attacker-supplied binary on the installer's host. In parallel, it spawns a detached loop that connects nc to 121.127.33.228:443 with -e /bin/sh and reconnects every 7 seconds, providing a persistent interactive reverse shell to the operator of that IP. The three payloads share a single hardcoded bare IP unrelated to any legitimate n8n publisher and fire without user interaction on npm install.
Source: ossf-package-analysis (b77e4f7678fc2bc58ccaf452ce0a7ade1c3fc98c18b0af60350fd6c37343a990)
The OpenSSF Package Analysis project identified 'n8n-nodes-sysdiag2' @ 2.0.0 (npm) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.
- CWE-506 - The product contains code that appears to be malicious in nature.
{
"affected": [
{
"database_specific": {
"cwes": [
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
}
],
"indicators": {
"evidence_files": [
{
"path": "postinstall.js",
"sha256": "020693305bbdc27a95f650e82eab4ff0ae9f5e619fa4a2bdbd653eaecaadabd9",
"tlsh": "1601abf8feb48820319e85b5360d80a58d83ca7b09566e9540c78ef9260d68db21e9f1"
},
{
"path": "package.json",
"sha256": "aaae4b5f2284adb5febe9cf4f6acaec20667148449fc59020deb4538c684a23b",
"tlsh": "eee026248c719b7720cc1a696c9bc145aa250dab8598fc28b2df00884b692755d7fb49"
}
],
"package_integrity": [
{
"filename": "n8n-nodes-sysdiag2-2.0.0.tgz",
"hashes": {
"sha1": "2a73ad4fb095b0a04a8201269566a5c3e56ac1b1",
"sha512_sri": "sha512-auAcDW1upwP9JRmVWvqhqkF/lbQlFi21klectGw27JVoKfLCu4ZNrx/LLSrRIoflpdH9+O0krNaGRxyuhtfv9g=="
}
}
]
}
},
"package": {
"ecosystem": "npm",
"name": "n8n-nodes-sysdiag2"
},
"versions": [
"2.0.0"
]
}
],
"credits": [
{
"contact": [
"inspector-research@amazon.com"
],
"name": "Amazon Inspector",
"type": "FINDER"
},
{
"contact": [
"https://github.com/ossf/package-analysis",
"https://openssf.slack.com/channels/package_analysis"
],
"name": "OpenSSF: Package Analysis",
"type": "FINDER"
}
],
"database_specific": {
"malicious-packages-origins": [
{
"import_time": "2026-09-14T22:16:57.958317554Z",
"modified_time": "2026-09-14T22:01:42Z",
"sha256": "b77e4f7678fc2bc58ccaf452ce0a7ade1c3fc98c18b0af60350fd6c37343a990",
"source": "ossf-package-analysis",
"versions": [
"2.0.0"
]
},
{
"id": "IN-MAL-2026-020051",
"import_time": "2026-09-15T16:19:14.359779131Z",
"modified_time": "2026-09-15T15:53:27Z",
"sha256": "7cde3a20bc24f39c8a55a9f700f50c39dd42cbbab51c57ddf9fbbb54307ee7a8",
"source": "amazon-inspector",
"versions": [
"2.0.0"
]
}
]
},
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7cde3a20bc24f39c8a55a9f700f50c39dd42cbbab51c57ddf9fbbb54307ee7a8)\nThe package advertises itself as an n8n community node for system diagnostics, but the shipped node module (dist/SysDiag.node.js) is an inert stub returning [{ok:true}] and the package\u0027s main is a one-line empty export. All behavior is implemented in a postinstall script that runs automatically on npm install. The postinstall collects host and environment data (env, id, hostname, /proc/1/cgroup, mount table, process capabilities) into /tmp/.be and posts it via wget --post-file to http://121.127.33.228:8443/env2 over plain HTTP. It also downloads http://121.127.33.228:8444/mn8n2 to /tmp/.mn2, chmod +x, and launches it detached via nohup, executing an opaque attacker-supplied binary on the installer\u0027s host. In parallel, it spawns a detached loop that connects nc to 121.127.33.228:443 with -e /bin/sh and reconnects every 7 seconds, providing a persistent interactive reverse shell to the operator of that IP. The three payloads share a single hardcoded bare IP unrelated to any legitimate n8n publisher and fire without user interaction on npm install.\n\n## Source: ossf-package-analysis (b77e4f7678fc2bc58ccaf452ce0a7ade1c3fc98c18b0af60350fd6c37343a990)\nThe OpenSSF Package Analysis project identified \u0027n8n-nodes-sysdiag2\u0027 @ 2.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n",
"id": "MAL-2026-16162",
"modified": "2026-09-15T16:21:13.417226825Z",
"published": "2026-09-14T22:01:42Z",
"references": [
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/n8n-nodes-sysdiag2/v/2.0.0"
}
],
"schema_version": "1.7.4",
"summary": "Malicious code in n8n-nodes-sysdiag2 (npm)"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.