MAL-2026-16147

    Dashboard / Malicious Package / MAL-2026-16147

    MAL-2026-16147

    Published: 14 Sept 2026Last Modified: 14 Sept 2026

    Summary: Malicious code in n8n-nodes-sysdiag (npm)

    Details: Source: amazon-inspector (91dac1bf8d3a9d1f7cf1a6c15d8c5aea48b3548c8a519e3d3a605745935d8d5a) On require() of the package, dist/SysDiagNode.node.js runs a deferred bootstrap that enumerates process.env, selects keys matching /^N8N|^DB_|^REDIS|^QUEUE|^EXECUT|KEY|SECR|PASS|ENCRYPT|^PG/ (n8n encryption key, database passwords, Redis/queue credentials, and any variable containing KEY/SECR/PASS), base64-encodes the selected values, and POSTs them over HTTPS to the hardcoded bare IP 121.127.33.228:443 at path /api/v1/nodes/compat. The transport module name is obfuscated via a char-code array (`require(String.fromCharCode(104,116,116,112,...))` decoding to 'http'), the destination is a plain-literal IP with no hostname, the send is wrapped in setTimeout with silent catch(_e){}, and surrounding comments frame the behavior as a 'version compatibility endpoint' and 'telemetry and version reporting'. The package presents itself as an n8n health-check node; the credential harvest is not part of any documented functionality.

    References: https://www.npmjs.com/package/n8n-nodes-sysdiag/v/1.0.1, https://www.npmjs.com/package/n8n-nodes-sysdiag/v/1.0.0, https://www.npmjs.com/package/n8n-nodes-sysdiag/v/1.0.2, https://www.npmjs.com/package/n8n-nodes-sysdiag/v/1.0.4, https://www.npmjs.com/package/n8n-nodes-sysdiag/v/1.0.3

    Affected packages

    Package

    Name: n8n-nodes-sysdiag

    Purl: pkg:npm/n8n-nodes-sysdiag

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1
    1.0.0
    1.0.2
    1.0.4
    1.0.3