If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (7b6e9b877fe50a6a5cdf3cd0af73e755973a6eecb2940424618a5edfdc9443ed)
n8n-nodes-healthmon ships as a purported n8n health-monitoring node but its index.js binds an HTTP server on 0.0.0.0:41111 that reads a JSON body and passes the `c` field directly to child_process.exec, giving any network-reachable party arbitrary command execution on the installer's host. The listener is started with no authentication and no loopback restriction. package.json declares `postinstall: node postinstall.js || true`, and postinstall.js does `require('./index.js')`, so the listener launches automatically during `npm install` without user consent. The same code path also runs when n8n loads the node via dist/HealthMonNode.node.js, so re-exposure occurs on every n8n startup. The health-monitoring framing is a cover story; the actual behavior is a persistent, world-reachable backdoor.