n8n-nodes-buildcheck@1.0.0

Analysis

The postinstall hook (postinstall.js) is a multi-stage implant. It collects environment variables, user identity, hostname, container cgroup, and process capabilities into /tmp/.be and POSTs them to hxxp://121[.]127[.]33[.]228:8443/env2. It then launches a persistent reverse shell that repeatedly connects to 121[.]127[.]33[.]228:443 via netcat (-e /bin/sh). Finally it logs into an internal n8n instance at 10[.]0[.]3[.]2:5678 using hardcoded credentials ([account]), installs a second malicious community node (n8n-nodes-sysdiag2) through the n8n REST API, and reports the install result back to the C2 at hxxp://121[.]127[.]33[.]228:8443/chain.