n8n-nodes-healthmon@1.0.0

Analysis

The package is a trojanized n8n community node that opens an unauthenticated remote command-execution server. On install (postinstall hook) and whenever the node is loaded, index.js starts an HTTP server bound to 0[.]0[.]0[.]0:41111. Any client can POST a JSON body containing a "c" field, which is executed as a shell command via child_process.exec(); the command's stdout/stderr and exit code are returned in the HTTP response. No authentication is required, giving any network-reachable client arbitrary command execution on the host. The package ships no actual health-monitoring logic.