MAL-2026-7018

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/n8n-nodes-barcode-generator/MAL-2026-7018.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-7018
Published
2026-07-08T19:30:21Z
Modified
2026-07-08T19:46:50.279926929Z
Summary
Malicious code in n8n-nodes-barcode-generator (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (eb55ae2b864b933ae071cb33e8f53a52005ff0dc26487d15639f3b07fa7d9849)

The package presents itself as an n8n community node for barcode generation, but dist/credentials/BarcodeGeneratorApi.credentials.js contains a top-level IIFE that runs automatically when n8n loads the credential module. The loader reads the n8n encryption key from /home/node/.n8n/config, collects environment variables (N8NHOST, N8NPORT, N8NENCRYPTIONKEY, WEBHOOKURL, NODEENV), reads the first 2MB of /home/node/.n8n/database.sqlite and base64-encodes it, and POSTs the bundle to a hardcoded webhook.site endpoint (https://webhook.site/2b079e8c-0b80-4e65-a3a7-12990c032e93). Errors and network timeouts are silently swallowed (req.on('error', ()=>{}), req.setTimeout(5000)), and a benign-looking BarcodeGeneratorApi credential class is placed below the IIFE as a facade (comments in the file explicitly label the IIFE as the exfiltration hook). The n8n encryption key together with the SQLite database allows an attacker to decrypt every credential stored in the victim's n8n instance — API keys, database passwords, and OAuth tokens for all connected services — resulting in full tenant compromise.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-08T19:33:49.857873283Z",
            "source": "amazon-inspector",
            "sha256": "eb55ae2b864b933ae071cb33e8f53a52005ff0dc26487d15639f3b07fa7d9849",
            "versions": [
                "1.0.3"
            ],
            "id": "IN-MAL-2026-008253",
            "modified_time": "2026-07-08T19:30:21Z"
        }
    ]
}
References
Credits

Affected packages

npm / n8n-nodes-barcode-generator

Package

Name
n8n-nodes-barcode-generator
View open source insights on deps.dev
Purl
pkg:npm/n8n-nodes-barcode-generator

Affected ranges

Affected versions

1.*
1.0.3

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "018120a58ab745302e933294875f51029521e107bd01ecbcbf9c93594f4db3c95f2be4",
            "sha256": "e76d5de38894056d66a238de08f683aab34b9886260089c7c14a4e8f7c6deca2",
            "path": "dist/credentials/BarcodeGeneratorApi.credentials.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-barcode-generator-1.0.3.tgz",
            "hashes": {
                "sha1": "f3b2794ab1a795f91ebb5a1684abfe3772be6de5",
                "sha512_sri": "sha512-IjGAMgdxbbpRjRZNTqaHiV1QFs5CKyu72nOow2PzYU6sFoj6JfLIwjSEqpICKhiFpLW32klG73HLUUg0HonWPw=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/n8n-nodes-barcode-generator/MAL-2026-7018.json"