n8n-nodes-sysdiag2npm
Advisory published Updated
n8n-nodes-sysdiag2 is a confirmed malicious npm package (MAL-2026-16162) that opens a backdoor for remote access (malicious version 2.0.0). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in n8n-nodes-sysdiag2 (npm)
What this malware does
The package advertises itself as an n8n community node for system diagnostics, but the shipped node module (dist/SysDiag.node.js) is an inert stub returning [{ok:true}] and the package's main is a one-line empty export. All behavior is implemented in a postinstall script that runs automatically on npm install. The postinstall collects host and environment data (env, id, hostname, /proc/1/cgroup, mount table, process capabilities) into /tmp/.be and posts it via wget --post-file to http://121.127.33.228:8443/env2 over plain HTTP. It also downloads http://121.127.33.228:8444/mn8n2 to /tmp/.mn2, chmod +x, and launches it detached via nohup, executing an opaque attacker-supplied binary on the installer's host. In parallel, it spawns a detached loop that connects nc to 121.127.33.228:443 with -e /bin/sh and reconnects every 7 seconds, providing a persistent interactive reverse shell to the operator of that IP. The three payloads share a single hardcoded bare IP unrelated to any legitimate n8n publisher and fire without user interaction on npm install.
The OpenSSF Package Analysis project identified 'n8n-nodes-sysdiag2' @ 2.0.0 (npm) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Backdoor / remote accessFind it
Search your lockfiles and build artifacts for n8n-nodes-sysdiag2 (version 2.0.0).
If you installed it — respond
n8n-nodes-sysdiag2 establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If n8n-nodes-sysdiag2 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
- OpenSSF: Package Analysis · finder
Detect & block this
O3 blocks n8n-nodes-sysdiag2-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.