Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Browse News Feed Stats Watchlists Beta About Contact

Malicious npm packages masquerading as n8n integrations to steal OAuth credentials

Malware Activity
First reported
Last updated
Happening score
H score 42
1 unique sources, 1 articles

Summary

Hide ▲

A set of eight npm packages impersonating n8n integrations is stealing developers' OAuth credentials, putting linked services and workflow access at risk. One package mimics a Google Ads integration to lure users into connecting an account. The code then stores tokens in the n8n credential store, decrypts them with n8n's master key, and exfiltrates them to attacker-controlled servers. Because community nodes run with the same privileges as n8n, the activity can expose multiple integrated services from a single malicious package.

Related Happenings

N8n security fixes after Pillar findings

Security Patch Release
First: 12.03.2026 17:28 Last: 12.03.2026 17:28 Sources 1

About this happening: **n8n** released an **initial patch update in December 2025** and **nine security fixes in early 2026** to address reported flaws in the workflow automation platform. The update c...

Open Happening

StripeApi.Net malicious NuGet package exfiltrating Stripe API tokens

Malware Activity
First: 26.02.2026 12:09 Last: 26.02.2026 12:09 Sources 1

About this happening: A malicious **StripeApi.Net** package on **NuGet** impersonated **Stripe.net** and quietly stole **Stripe API tokens**, putting developers in the **financial sector** at risk. The...

Open Happening

N8n sandbox escape flaws (multiple vulnerabilities)

Vulnerability
First: 04.02.2026 15:00 Last: 04.02.2026 15:00 Sources 1

About this happening: Two **maximum-severity sandbox-escape flaws** in **n8n** expose **self-hosted and cloud instances** to **complete server takeover** and **credential theft**. An **authenticated us...

Open Happening

N8n self-hosted community nodes disable guidance

Advisory/Mitigation
First: 12.01.2026 18:39 Last: 12.01.2026 18:39 Sources 1

How related: On self-hosted n8n instances, it's advised to disable community nodes by setting N8N_COMMUNITY_PACKAGES_ENABLED to false.

About this happening: n8n warned **self-hosted operators** to **disable community nodes** because malicious npm packages can run code with the same access as n8n and steal decrypted credentials. The gu...

Open Happening

Pkr_mtsi Windows loader delivers multiple payloads

Malware Activity
First: 07.01.2026 18:45 Last: 07.01.2026 18:45 Sources 1

About this happening: **pkr_mtsi** is a **Windows loader** now being used to push **trojanized installers** through **malvertising** and **SEO poisoning**, increasing initial-access risk for Windows us...

Open Happening

Timeline

  1. 12.01.2026 18:39 2 articles · 4mo ago

    Malicious npm packages impersonate n8n community nodes to steal OAuth tokens

    Initial Disclosure

    Threat actors uploaded eight npm packages that masqueraded as n8n community nodes to steal developers' OAuth credentials from n8n environments. One package, n8n-nodes-hfgjf-irtuinvcm-lasdqewriit, mimicked a Google Ads integration, prompted users to connect an advertising account, saved tokens in the n8n credential store, decrypted them with n8n's master key during workflow execution, and exfiltrated them to attacker-controlled servers.

    Show sources
    Open in new tab