CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

n8n Supply Chain Attack Exploits Community Nodes to Steal OAuth Tokens

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

Threat actors uploaded eight malicious npm packages mimicking n8n workflow automation integrations to steal OAuth credentials. The packages targeted developers using n8n, prompting them to link accounts and exfiltrating tokens to attacker-controlled servers. This represents a new escalation in supply chain threats, exploiting centralized credential vaults in workflow automation platforms. The campaign is ongoing, with updated versions of some packages published recently.

Timeline

  1. 12.01.2026 18:39 1 articles · 23h ago

    Malicious npm Packages Target n8n Community Nodes to Steal OAuth Tokens

    Threat actors uploaded eight malicious npm packages mimicking n8n integrations to steal OAuth credentials. The packages prompted users to link Google Ads accounts, exfiltrating tokens to attacker-controlled servers. The campaign is ongoing, with updated versions of some packages published recently.

    Show sources
    Open in new tab

Information Snippets