Malicious code in n8n-nodes-social-facebook (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9ff182b11223b46877e54226944a8ba245ad486dd9dfd1027810a42f9c9e06a1) This n8n community node advertises Facebook automation and instructs the operator to paste a full Facebook session JSON (captured via a Chrome extension) plus an optional Facebook user access token into the 'Facebook Session' credential. The entire dist/ tree is obfuscated with obfuscator.io (446-entry rotating RC4 string array, self-defending anti-debugger loop using 'debu'+'gger' constructor checks, while-true traps), and dist/utils/init.js zlib-inflates dist/main.we (an 8 MB Go-compiled WebAssembly blob, sha256 0b89b49afdddc89a0b74f6720e973de7d4a0ec1c4fbca13fd63a3d874ab656c3) and runs it via WebAssembly.instantiate, granting it global fetch plus full Node fs/path/os access via global.WeFS/WePath/WeOS. The WASM contains the hardcoded plaintext URL http://150.230.9.47:3001 (an Oracle Cloud bare IP) alongside symbols 'getUserAccessTokenByType', 'setUserAccessTokenByType', 'userAccessTokenFetchedAt', and 'DEBUG: Injected proxyUrl'. dist/nodes/Meta/FacebookHttpRequest.node.js passes the operator-supplied facebookSession and userAccessToken into the WASM-implemented request engine, which routes credential-bearing traffic to that C2 endpoint over cleartext HTTP. The destination is unrelated to any Facebook/Meta or n8n publisher infrastructure. Effect on the installer: every Facebook account whose session is configured into this node is handed to the operator of 150.230.9.47, who can then take over those accounts.
Malicious code in n8n-nodes-social-facebook (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9ff182b11223b46877e54226944a8ba245ad486dd9dfd1027810a42f9c9e06a1) This n8n community node advertises Facebook automation and instructs the operator to paste a full Facebook session JSON (captured via a Chrome extension) plus an optional Facebook user access token into the 'Facebook Session' credential. The entire dist/ tree is obfuscated with obfuscator.io (446-entry rotating RC4 string array, self-defending anti-debugger loop using 'debu'+'gger' constructor checks, while-true traps), and dist/utils/init.js zlib-inflates dist/main.we (an 8 MB Go-compiled WebAssembly blob, sha256 0b89b49afdddc89a0b74f6720e973de7d4a0ec1c4fbca13fd63a3d874ab656c3) and runs it via WebAssembly.instantiate, granting it global fetch plus full Node fs/path/os access via global.WeFS/WePath/WeOS. The WASM contains the hardcoded plaintext URL http://150.230.9.47:3001 (an Oracle Cloud bare IP) alongside symbols 'getUserAccessTokenByType', 'setUserAccessTokenByType', 'userAccessTokenFetchedAt', and 'DEBUG: Injected proxyUrl'. dist/nodes/Meta/FacebookHttpRequest.node.js passes the operator-supplied facebookSession and userAccessToken into the WASM-implemented request engine, which routes credential-bearing traffic to that C2 endpoint over cleartext HTTP. The destination is unrelated to any Facebook/Meta or n8n publisher infrastructure. Effect on the installer: every Facebook account whose session is configured into this node is handed to the operator of 150.230.9.47, who can then take over those accounts.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10536
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a55ff6468715ace432f1b94
Added to database: 07/14/2026, 09:20:36 UTC
Last enriched: 07/14/2026, 09:33:05 UTC
Last updated: 09/07/2026, 18:59:27 UTC
Views: 19
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.