Thousands of Companies Are Vulnerable: The N8N Supply Chain Attack Explained

An n8n supply chain attack has revealed a dangerous vulnerability in how workflow automation platforms handle third-party integrations. Threat actors recently deployed malicious packages disguised as legitimate tools to steal sensitive credentials from organizations relying on automation software. Unlike traditional malware that targets individual systems, this attack infiltrates centralized credential vaults where companies store API keys, OAuth tokens, and authentication data for multiple services in one location.

The campaign exploited community-maintained extensions by masquerading as a Google Ads connector. When developers installed what appeared to be an official integration, the malicious code activated during workflow execution to capture and transmit encrypted credentials to attacker-controlled servers. This method proved devastatingly effective because it bypassed traditional security checks and leveraged the trust users place in automation platforms.

Why Automation Platforms Have Become High-Value Targets

Workflow automation tools like n8n function as credential management hubs for modern businesses. Teams use these platforms to connect dozens of services—from payment processors to advertising tools to data repositories—all accessible through a single interface. This centralization, while convenient, creates an attractive attack surface for cybercriminals seeking high-value authentication data.

The specific risks include:

• No Vetting Process: Third-party extensions enter the ecosystem without security reviews or code audits. Anyone can publish packages, and organizations often install them without thorough inspection.
• Inherited Trust: Users trust the platform itself, and this confidence naturally extends to available tools. Attackers exploit this psychological transfer of trust.
• Unrestricted Credential Access: Extensions receive decrypted credentials at runtime. The platform automatically decrypts sensitive data and hands it to node code, assuming the code acts responsibly.
• Unrestricted Network Communication: Extensions can send arbitrary data anywhere on the internet without network-level restrictions.
• Operating System Access: Since extensions run in Node.js environments, they operate with full access to system files, environment variables, and local resources.

How the Attack Unfolded

The malicious package, named non-nodes-hfgjf-irtuinvcm-lasdqewriit, appeared identical to legitimate integrations in the workflow editor. When users configured it with their Google Ads account information, they unknowingly surrendered their complete OAuth credentials, developer tokens, and account identifiers. During workflow execution, the extension retrieved the decrypted credentials from the n8n database and exfiltrated them to an attacker command-and-control server hosted on onrender.com.

This single compromise could grant attackers control over advertising budgets, billing information, and campaign management for affected organizations.

Red Flags in the Malicious Package

Organizations should have spotted several warning signs before installing this extension:

How N8N's Credential Storage System Works

Understanding the attack requires knowing how n8n secures credentials:

• Entry Point: Users enter authentication details into credential configuration forms integrated directly into the workflow editor.
• Validation Layer: The system validates required fields and checks format compliance before accepting input.
• Encryption Process: All sensitive data undergoes AES-256 encryption using n8n's master security key.
• Database Storage: Encrypted credentials store in the local SQLite database file located in ~/.n8n/database.sqlite.
• Workflow Linking: The system generates a credential ID that gets referenced in the workflow configuration rather than storing raw passwords.

The Critical Vulnerability: Runtime Credential Access

When a user executes a workflow, n8n calls the execute() function of each node sequentially. The malicious node exploited this process through legitimate n8n APIs:

The node requested credentials using this.getCredentials('googleAdsOAuth2Api'), which triggered n8n's internal security protocols:

At this moment, the malicious code received unencrypted credentials in memory and immediately transmitted them to the attacker's server. The platform had no mechanism to prevent this misuse because it trusted all installed extensions equally.

Comparing Security Across Automation Platforms

Protecting Your Organization From Similar Attacks

• Prioritize Official Integrations:
  Always use built-in connectors before considering third-party extensions. Official nodes undergo security review and benefit from dedicated maintenance.
• Review Source Code:
  Before installation, examine the actual code on GitHub or npm. Look for legitimate documentation, recent updates, and active community engagement.
• Implement Network Monitoring:
  Deploy outbound traffic inspection tools that flag unusual external connections from automation servers.
• Use Least Privilege Credentials:
  Create service accounts with minimal required permissions rather than using master credentials.
• Audit Access Logs:
  Regularly review which extensions are installed and when they were added.
• Test in Isolated Environments:
  Deploy new extensions in testing systems first. Monitor their behavior before enabling them in production workflows.

FAQ: N8N Supply Chain Attack Questions

What is the main risk from the n8n supply chain attack?
The primary risk involves malicious extensions stealing encrypted credentials stored in workflow automation platforms. Once an attacker controls a single community node, they gain access to authentication tokens for dozens of integrated services.

How many organizations were affected?
Security researchers identified over 100,000 n8n servers vulnerable to related remote code execution flaws during the attack window.

Can traditional antivirus software detect this?
Standard antivirus tools struggle with this threat because the malicious code behaves like legitimate software. Detection requires behavioral analysis of outbound network traffic or source code review.

What should I do if I installed an unknown community node?
Immediately remove the extension from your n8n instance. Rotate all credentials used by that workflow, especially OAuth tokens and API keys. Review access logs to identify what data might have been exposed. Consider deploying fresh credentials with limited permissions on affected systems.

Why doesn't n8n require code review before publishing community packages?
The platform prioritizes accessibility and rapid innovation, allowing developers to quickly extend functionality without central approval processes. This approach enabled the n8n ecosystem to grow rapidly but sacrificed security controls that larger platforms enforce.

Are other automation platforms vulnerable to similar attacks?
Yes. Any automation platform that allows third-party code execution, particularly those storing credentials centrally, faces similar risks. Zapier, Make, and other workflow tools share this architectural weakness, though each implements different security controls.

How can I verify that a community node is legitimate before installing it?
Check for active GitHub repositories with substantial commit history, review the developer's profile and other published packages, examine the npm registry page for complete documentation and recent updates, and search for security advisories or known vulnerabilities. Packages from unverified publishers with minimal documentation warrant extreme caution.