n8n-nodes-sysdiag2@2.0.0

Analysis

The postinstall hook (postinstall.js) runs three malicious commands on install. It collects environment variables, user identity, hostname, container cgroup, mount table, and process capabilities into /tmp/.be and POSTs them to hxxp://121[.]127[.]33[.]228:8443/env2. It then launches a persistent reverse shell via busybox nc to 121[.]127[.]33[.]228:443 with a 7-second reconnect loop, and downloads a second-stage binary from hxxp://121[.]127[.]33[.]228:8444/mn8n2 to /tmp/.mn2, makes it executable, and runs it detached. Errors are swallowed and the hook ends with || true so installation appears to succeed. The package masquerades as an n8n community node but contains only a stub node file; the real behaviour is the install-time implant.