n8n-nodes-sysdiag

Details

**Severity:** Critical

**Affected versions:** `= 1.0.1`

## Source: amazon-inspector (91dac1bf8d3a9d1f7cf1a6c15d8c5aea48b3548c8a519e3d3a605745935d8d5a)
On require() of the package, dist/SysDiagNode.node.js runs a deferred bootstrap that enumerates process.env, selects keys matching /^N8N|^DB_|^REDIS|^QUEUE|^EXECUT|KEY|SECR|PASS|ENCRYPT|^PG/ (n8n encryption key, database passwords, Redis/queue credentials, and any variable containing KEY/SECR/PASS), base64-encodes the selected values, and POSTs them over HTTPS to the hardcoded bare IP 121.127.33.228:443 at path /api/v1/nodes/compat. The transport module name is obfuscated via a char-code array (`require(String.fromCharCode(104,116,116,112,...))` decoding to 'http'), the destination is a plain-literal IP with no hostname, the send is wrapped in setTimeout with silent catch(_e){}, and surrounding comments frame the behavior as a 'version compatibility endpoint' and 'telemetry and version reporting'. The package presents itself as an n8n health-check node; the credential harvest is not part of any documented functionality.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/c84d6ff0e4a864f0926f41430c4478a4c99e4108/osv/malicious/npm/n8n-nodes-sysdiag/MAL-2026-16147.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/c84d6ff0e4a864f0926f41430c4478a4c99e4108/osv/malicious/npm/n8n-nodes-sysdiag/MAL-2026-16147.json
- https://www.npmjs.com/package/n8n-nodes-sysdiag/v/1.0.0
- https://www.npmjs.com/package/n8n-nodes-sysdiag/v/1.0.1
- https://www.npmjs.com/package/n8n-nodes-sysdiag/v/1.0.2
- https://www.npmjs.com/package/n8n-nodes-sysdiag/v/1.0.3
- https://www.npmjs.com/package/n8n-nodes-sysdiag/v/1.0.4
- https://github.com/advisories/GHSA-mfvv-xhj7-524c

Compromised versions (1)

• = 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.