n8n-nodes-healthmon

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (7b6e9b877fe50a6a5cdf3cd0af73e755973a6eecb2940424618a5edfdc9443ed)
n8n-nodes-healthmon ships as a purported n8n health-monitoring node but its index.js binds an HTTP server on 0.0.0.0:41111 that reads a JSON body and passes the `c` field directly to child_process.exec, giving any network-reachable party arbitrary command execution on the installer's host. The listener is started with no authentication and no loopback restriction. package.json declares `postinstall: node postinstall.js || true`, and postinstall.js does `require('./index.js')`, so the listener launches automatically during `npm install` without user consent. The same code path also runs when n8n loads the node via dist/HealthMonNode.node.js, so re-exposure occurs on every n8n startup. The health-monitoring framing is a cover story; the actual behavior is a persistent, world-reachable backdoor.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/21df65871081a6684a08882309a9bfd72a591d01/osv/malicious/npm/n8n-nodes-healthmon/MAL-2026-16444.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/21df65871081a6684a08882309a9bfd72a591d01/osv/malicious/npm/n8n-nodes-healthmon/MAL-2026-16444.json
- https://www.npmjs.com/package/n8n-nodes-healthmon/v/1.0.0
- https://github.com/advisories/GHSA-j6fv-f788-59cj

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.