n8n Supply Chain Attack Abuses Community Nodes to Steal OAuth Tokens

Threat actors uploaded eight npm packages that posed as n8n integrations to siphon developers’ OAuth credentials, with one package mimicking a Google Ads integration and prompting users to link their advertising account.

According to Endor Labs, the campaign escalates supply chain threats by exploiting workflow automation platforms that act as central credential vaults for services such as Google Ads, Stripe, and Salesforce, storing tokens in the n8n credential store and decrypting them during workflow execution to exfiltrate to a remote server.

The complete package list included n8n-nodes-hfgjf-irtuinvcm-lasdqewriit (4,241 downloads, author: kakashi-hatake), n8n-nodes-ggdv-hdfvcnnje-uyrokvbkl (1,657 downloads, author: kakashi-hatake), n8n-nodes-vbmkajdsa-uehfitvv-ueqjhhhksdlkkmz (1,493 downloads, author: kakashi-hatake), and n8n-nodes-danev (5,525 downloads, author: dan_even_segler), among others.

The researchers noted that an updated version of the package n8n-nodes-gg-udhasudsh-hgjkhg-official appeared on npm just three hours ago, suggesting the campaign may still be active. n8n has warned about the security risks of community nodes, advising auditing packages and disabling community nodes on self-hosted instances, while emphasising that community nodes run with the same access as the n8n runtime.