MalwarePublished 14 Jul 2026Updated 4 Sep 2026

n8n-nodes-social-facebook (npm) · Malicious Code

Affects n8n-nodes-social-facebookSource GCVE Database

Malicious package : remove n8n-nodes-social-facebook and rotate any secrets on hosts that installed it.

Data as of 12 Sep 2026, 16:18 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10536

What to do

Remove n8n-nodes-social-facebook from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmn8n-nodes-social-facebook	Affected =0.1.96	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The n8n-nodes-social-facebook npm package version 0.1.96 contains malicious code that exfiltrates Facebook session credentials. It uses heavy obfuscation and a large WebAssembly payload to send operator-supplied Facebook session JSON and user access tokens to a command-and-control server at a non-Facebook IP address. This allows the attacker to take over Facebook accounts configured in this node.

Impact

Any Facebook account whose session credentials are supplied to this compromised node can be fully taken over by the attacker controlling the external C2 server. This results in complete account compromise and potential misuse of Facebook accounts without the knowledge of the legitimate user.

Defensive guidance

Users should immediately stop using version 0.1.96 of the n8n-nodes-social-facebook package. Avoid supplying Facebook session credentials to this node. Monitor for updates from the package maintainers or the n8n community for any official fixes or advisories. Consider removing this package from your environment to prevent credential theft.

Summary

The n8n-nodes-social-facebook package (version 0.1.96) includes obfuscated JavaScript and a large Go-compiled WebAssembly module that executes with broad Node.js system access. It accepts Facebook session credentials from the operator and routes these credentials via a WebAssembly-implemented request engine to a hardcoded external command-and-control server over unencrypted HTTP. The C2 server is unrelated to Facebook or n8n infrastructure. This behavior enables the attacker controlling the C2 server to hijack Facebook accounts whose sessions are configured in the node.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Sep 2026, 16:18 UTC

Technical details

References

Community reviews