MAL-2026-16147

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/n8n-nodes-sysdiag/MAL-2026-16147.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16147
Published
2026-09-14T16:45:49Z
Modified
2026-09-14T17:30:06Z
Summary
Malicious code in n8n-nodes-sysdiag (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (91dac1bf8d3a9d1f7cf1a6c15d8c5aea48b3548c8a519e3d3a605745935d8d5a)

On require() of the package, dist/SysDiagNode.node.js runs a deferred bootstrap that enumerates process.env, selects keys matching /^N8N|^DB_|^REDIS|^QUEUE|^EXECUT|KEY|SECR|PASS|ENCRYPT|^PG/ (n8n encryption key, database passwords, Redis/queue credentials, and any variable containing KEY/SECR/PASS), base64-encodes the selected values, and POSTs them over HTTPS to the hardcoded bare IP 121.127.33.228:443 at path /api/v1/nodes/compat. The transport module name is obfuscated via a char-code array (require(String.fromCharCode(104,116,116,112,...)) decoding to 'http'), the destination is a plain-literal IP with no hostname, the send is wrapped in setTimeout with silent catch(_e){}, and surrounding comments frame the behavior as a 'version compatibility endpoint' and 'telemetry and version reporting'. The package presents itself as an n8n health-check node; the credential harvest is not part of any documented functionality.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020028",
            "import_time":  "2026-09-14T17:15:21.069814053Z",
            "modified_time":  "2026-09-14T16:45:49Z",
            "sha256":  "2902b0bf06d599569fe0bf596e4bbf0014cfab3b98e00f2e529ae01626e34238",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-020029",
            "import_time":  "2026-09-14T17:15:21.183956387Z",
            "modified_time":  "2026-09-14T16:45:56Z",
            "sha256":  "91dac1bf8d3a9d1f7cf1a6c15d8c5aea48b3548c8a519e3d3a605745935d8d5a",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-020032",
            "import_time":  "2026-09-14T17:15:21.457249112Z",
            "modified_time":  "2026-09-14T16:46:18Z",
            "sha256":  "977409e61123cba2eefd6c2a9baa24ada46514082c3ca57a1ef26595d5fe6095",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.2"
            ]
        },
        {
            "id":  "IN-MAL-2026-020030",
            "import_time":  "2026-09-14T17:15:21.331990168Z",
            "modified_time":  "2026-09-14T16:46:03Z",
            "sha256":  "c2878ba19f2514a4c0c553948978001ceb7fe70402173437051eaffe0e6f2228",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.4"
            ]
        },
        {
            "id":  "IN-MAL-2026-020031",
            "import_time":  "2026-09-14T17:15:21.399235887Z",
            "modified_time":  "2026-09-14T16:46:10Z",
            "sha256":  "fb7cc515edb8a403b549dce802d6cd24f6a2eb54fa665890e4f050cc2a7ae1a4",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / n8n-nodes-sysdiag

Package

Name
n8n-nodes-sysdiag
View open source insights on deps.dev
Purl
pkg:npm/n8n-nodes-sysdiag

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "dist/SysDiagNode.node.js",
            "sha256":  "f7a11bebf33903d5541cfca1f4ff37b1196e4e826e1d8ba3ef289d9bad58d70e",
            "tlsh":  "d25120a94ab691521572b1821b5b600262b593077918fcbabbcc231d2f0e82cc1f27dd"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "n8n-nodes-sysdiag-1.0.1.tgz",
            "hashes":  {
                "sha1":  "262ec9b503d9b409c6aff7c520d83bc06ba198fb",
                "sha512_sri":  "sha512-8ZqePP/GN8o8VPrPJbHg/uwtgu1aTFTU/uWnN+mhuWMERmMfoiFtSb5aecffA+CJs6dWHSVx5AGhvtHmfgan+Q=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/n8n-nodes-sysdiag/MAL-2026-16147.json"