Loading story…
Threat actors published malicious npm packages masquerading as legitimate n8n community nodes, abusing n8n’s extensibility to steal OAuth tokens and other sensitive credentials from environments that installed the rogue integrations. Reporting identified at least eight fake nodes impersonating popular services (e.g., Google Ads, Stripe, Salesforce), including n8n-nodes-hfgjf-irtuinvcm-lasdqewriit and n8n-nodes-gasdhgfuy-rejerw-ytjsadx, with authors using pseudonymous handles such as kakashi-hatake, zabuza-momochi, dan_even_segler, hezi109, haggags, vietts_code, and diendh. The packages prompted users to authenticate in seemingly legitimate flows and then exfiltrated credentials to attacker-controlled infrastructure; several packages were removed after discovery, while additional related packages from some of the same accounts were still being tracked for potentially similar behavior.
Separately, a government advisory warned of multiple high-severity vulnerabilities in n8n—including CVE-2026-21858 (improper input validation that may enable unauthenticated remote code execution via webhook request parsing and file handling), alongside CVE-2026-21877 and CVE-2025-68613—and provided mitigation and detection guidance for defenders. This vulnerability advisory is distinct from the npm supply-chain campaign (malicious third-party nodes vs. core product flaws), but both issues increase risk for organizations running n8n, particularly self-hosted deployments that may function as centralized stores for OAuth tokens, API keys, and other integration secrets.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
Researchers and reporting sources advised organizations to prefer built-in or official integrations, audit and remove suspicious community nodes, monitor outbound traffic from automation hosts, rotate exposed credentials, and restrict privileges with isolated service accounts. Guidance also included disabling community packages on self-hosted n8n instances and upgrading to n8n 1.121.0+ or 2.x.
Endor Labs reported the campaign, describing it as an escalation of supply-chain abuse into workflow automation platforms and warning that n8n community nodes run with full privileges and no sandboxing. The disclosure highlighted the risk that automation platforms act as centralized credential vaults embedded in business workflows.
By the time researchers disclosed the campaign, the known malicious packages had begun to be disabled or removed from npm, but several related packages tied to the same accounts remained available and at least one had been recently updated. This indicated the campaign was ongoing and evolving despite takedown efforts.
Once installed, the rogue nodes presented legitimate-looking authentication flows, captured OAuth tokens and API keys, decrypted stored credentials using n8n's master key, and exfiltrated them to attacker-controlled servers during workflow execution. Reports indicated active exploitation in the wild, including unauthorized access affecting services such as Google Ads, Stripe, and Salesforce.
Threat actors uploaded at least eight malicious npm packages masquerading as legitimate n8n community-node integrations, including a fake Google Ads connector. The packages targeted the n8n workflow automation ecosystem as a software supply-chain attack aimed at stealing credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcerescana.com
Open sourcecsoonline.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A maximum-severity vulnerability, tracked as CVE-2026-21858 and dubbed 'Ni8mare,' was disclosed in the n8n workflow automation platform, allowing unauthenticated remote code execution and potential full system compromise on locally deployed instances running versions prior to 1.121.0. The flaw arises from improper validation of incoming data in form-based workflows, enabling attackers to craft requests that bypass expected content-type checks and execute arbitrary code. This vulnerability has drawn significant attention in the security community, with reports highlighting the risk of full environment compromise and the rapid exploitation potential due to n8n's widespread use in automation and integration workflows. Concurrently, underground forums have surfaced with alleged exploit sales targeting n8n, further amplifying the threat landscape for organizations relying on this platform. In addition to the core vulnerability, researchers identified a supply chain attack involving malicious npm packages masquerading as legitimate n8n integrations. These packages, once installed, exfiltrate OAuth tokens and API keys from enterprise workflows, representing a new escalation in supply chain threats targeting automation platforms. While there is no confirmed link between the npm supply chain attack and the CVE-2026-21858 vulnerability, both incidents underscore the growing focus of threat actors on the n8n ecosystem. Security experts warn that organizations may overlook these risks, as automation platforms often operate deep within business processes and may not be subject to the same scrutiny as traditional build systems. The convergence of a critical RCE flaw and active supply chain threats highlights the urgent need for patching, vigilant monitoring of third-party integrations, and enhanced supply chain security practices for n8n deployments.
Jun 29, 2026
Threat actors are using **malicious npm packages** to steal developer credentials and CI/CD secrets, enabling rapid escalation into cloud environments. Google reported that **UNC6426** leveraged keys stolen during the earlier compromise of the *nx* npm ecosystem to pivot from a stolen developer GitHub token into **AWS administrative access within 72 hours**, abusing **GitHub-to-AWS OpenID Connect (OIDC) trust** to create a new admin role. The actor then used that access to **exfiltrate data from AWS S3** and conduct **destructive actions** in production cloud environments; the initial *nx* compromise involved a GitHub Actions `pull_request_target` workflow abuse (“**Pwn Request**”) that enabled publishing trojanized packages containing a `postinstall` chain that executed the **QUIETVAULT** JavaScript credential stealer and uploaded stolen data to a public GitHub repo (`/s1ngularity-repository-1`). Separately, researchers reported new waves of the **PhantomRaven** npm supply-chain campaign distributing **88 additional malicious packages** (via ~50 disposable accounts) that target JavaScript developers by exfiltrating secrets from files like `.gitconfig` and `.npmrc`, environment variables, and CI/CD tokens (e.g., GitHub/GitLab/Jenkins/CircleCI). The campaign uses **slopsquatting** (LLM-suggested lookalike package names) and a stealth technique called **Remote Dynamic Dependencies (RDD)**, where `package.json` pulls a dependency from an external URL so the malicious payload is fetched at install time (`npm install`) and can evade static package inspection; researchers indicated many of these packages remained available in the npm registry at the time of reporting.
Jun 29, 2026
n8n published security advisories for multiple supported release branches after disclosure of several vulnerabilities, including a critical flaw tracked as **`CVE-2026-56348`**. The CVE affects versions before **`2.20.0`** and allows an authenticated user to abuse the **`POST /rest/dynamic-node-parameters/options`** endpoint to bypass **Allowed HTTP Request Domains** restrictions, causing the server to send credential-bearing HTTP requests to unauthorized hosts and potentially exfiltrate sensitive authentication data. The issue is remotely exploitable and impacts environments where users can access affected dynamic node functionality. The broader advisory set also covers additional n8n weaknesses in releases prior to **`2.28.1`**, **`2.27.4`**, and **`1.123.61`**, including another Allowed HTTP Request Domains bypass through the **AI Agents MCP Connector**, prototype pollution via workflow credentials that can lead to unauthenticated user and project enumeration, cross-issuer token exchange account binding caused by subject-only identity resolution, and a shared credential header leak through HTTP request pagination expressions. The Canadian Centre for Cyber Security urged administrators to review the advisories, upgrade to the patched versions, restrict access to exposed endpoints where possible, and monitor for unauthorized outbound requests that could indicate credential leakage.
Jun 29, 2026