Post #8192

🚨 Attackers uploaded fake n8n community nodes to npm to steal OAuth tokens from live workflows. The packages mimicked real integrations, ran with full n8n access, decrypted credentials during execution, and exfiltrated them. Eight were removed, but activity appears ongoing. 🔗 Read about it here → https://thehackernews.com/2026/01/n8n-supply-chain-attack-abuses.html