Threat actors uploaded 8 malicious packages to npm registry masquerading as n8n integrations. The packages, such as 'n8n-nodes-hfgjf-irtuinvcm-lasdqewriit', mimic legitimate integrations like Google Ads. Once installed as community nodes, they display configuration screens and save OAuth tokens in encrypted format to n8n credential store. During workflow execution, malicious code decrypts stored tokens using n8n's master key and exfiltrates them to attacker-controlled servers. Community nodes run with same access level as n8n itself, with no sandboxing or isolation, allowing access to environment variables, file system, and network requests.