MAL-2026-16444

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/n8n-nodes-healthmon/MAL-2026-16444.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16444
Published
2026-09-23T02:44:13Z
Modified
2026-09-23T03:00:06Z
Summary
Malicious code in n8n-nodes-healthmon (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7b6e9b877fe50a6a5cdf3cd0af73e755973a6eecb2940424618a5edfdc9443ed)

n8n-nodes-healthmon ships as a purported n8n health-monitoring node but its index.js binds an HTTP server on 0.0.0.0:41111 that reads a JSON body and passes the c field directly to child_process.exec, giving any network-reachable party arbitrary command execution on the installer's host. The listener is started with no authentication and no loopback restriction. package.json declares postinstall: node postinstall.js || true, and postinstall.js does require('./index.js'), so the listener launches automatically during npm install without user consent. The same code path also runs when n8n loads the node via dist/HealthMonNode.node.js, so re-exposure occurs on every n8n startup. The health-monitoring framing is a cover story; the actual behavior is a persistent, world-reachable backdoor.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020341",
            "import_time":  "2026-09-23T02:46:21.718049828Z",
            "modified_time":  "2026-09-23T02:44:13Z",
            "sha256":  "7b6e9b877fe50a6a5cdf3cd0af73e755973a6eecb2940424618a5edfdc9443ed",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / n8n-nodes-healthmon

Package

Name
n8n-nodes-healthmon
View open source insights on deps.dev
Purl
pkg:npm/n8n-nodes-healthmon

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "9b1c598283db644a30908c2ed57a5faeceef021be82f7c166a6912bd36363682",
            "tlsh":  "f521894619f3393746b7922e975fc51ab22bc007d199cea1fa8c11a56fc092441e0ae8"
        },
        {
            "path":  "postinstall.js",
            "sha256":  "1dea7db3d22288c5f10a21f28987308ea08267b8bea910eb8705ecc2564df6a4"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "n8n-nodes-healthmon-1.0.0.tgz",
            "hashes":  {
                "sha1":  "61a4272ba3483a192b31c95ab1dee4614beebac6",
                "sha512_sri":  "sha512-Ei9vEzBHoCusc15t2m5Wbctr65gBATpINyj4PeWRPb8W73+zjphm3JRkoCdx4B3k98m5gcYCQPOCzBQonXM5Pw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/n8n-nodes-healthmon/MAL-2026-16444.json"