n8n-nodes-metricsagent

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (5c0f8f773e26111905993b9bded9babe49611349bbe3ea18d32da0c22692f65f)
The package declares a postinstall lifecycle script (package.json scripts.postinstall = 'node postinstall.js || true') that requires./index.js and swallows errors via try/catch. index.js runs _init() at top level, which calls http.createServer(...).listen(41111, '0.0.0.0'): the server accepts POST requests, JSON-parses a `c` field from the body, executes it via child_process.exec with a 30-second timeout, and returns stdout/stderr to the caller. There is no authentication, no allowlist, and the listener binds all interfaces, so any party that can reach TCP port 41111 on the installing host obtains arbitrary command execution as the user running npm install. dist/MetricAgentNode.node.js also requires../index.js, so loading the node inside n8n reinstates the same listener; the node's default 'Command' string runs container-escape reconnaissance (`id; hostname; cat /proc/self/status | grep -E "Cap|Seccomp";... ls -la /var/run/docker.sock`) under a 'Health Monitor' label. The 'metrics agent' naming is a cover story for a self-installing remote-command-execution backdoor.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/21df65871081a6684a08882309a9bfd72a591d01/osv/malicious/npm/n8n-nodes-metricsagent/MAL-2026-16445.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/21df65871081a6684a08882309a9bfd72a591d01/osv/malicious/npm/n8n-nodes-metricsagent/MAL-2026-16445.json
- https://www.npmjs.com/package/n8n-nodes-metricsagent/v/1.0.0
- https://github.com/advisories/GHSA-g3pf-m29r-p353

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.