The n8n-nodes-social-facebook npm package version 0.1.96 contains malicious code that exfiltrates Facebook session credentials. It uses heavy obfuscation and a large WebAssembly payload to send operator-supplied Facebook session JSON and user access tokens to a command-and-control server at a non-Facebook IP address. This allows the attacker to take over Facebook accounts configured in this node.