registry / Remote code execution / n8n-nodes-social-facebook
n8n-nodes-social-facebook
n8n node for social automation like Meta, Facebook
This report shows the evidence for n8n-nodes-social-facebook@0.2.0. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe published node is fully obfuscated and, on import, runs a concealed Go WebAssembly payload after exposing Node filesystem and OS APIs to it. That is hidden code execution in the host process, not a normal Facebook API client.
Static reason
One or more suspicious static signals were detected.
Trigger
n8n loads dist/nodes/Meta/Facebook.node.js, which invokes the init export at import time.
Impact
The hidden binary runs in the n8n process with host filesystem and network capability as soon as the node is loaded, before a user runs a Facebook workflow.
Mechanism
init.js publishes fs, path, and os on global, reads a packaged file whose name ends in we, and instantiates that buffer through the Go wasm bridge in dist/we.js, which exposes syscall/js.
Attack narrative
When n8n imports the Facebook node, an async call at the top of Facebook.node.js starts the obfuscated initializer. That module requires the filesystem, path, os, zlib, and proxy agents, then stores fs, path, and os on the global object for the Go runtime. It loads a packaged file ending in we and instantiates it with WebAssembly through dist/we.js, which provides syscall/js. The shipped binary therefore executes inside the n8n process with file and network access as soon as the node loads.
AI rationale
The published node is fully obfuscated and, on import, runs a concealed Go WebAssembly payload after exposing Node filesystem and OS APIs to it. That is hidden code execution in the host process, not a normal Facebook API client.
Evidence
dist/nodes/Meta/Facebook.node.jsdist/utils/init.jsdist/we.jspackage.jsondist/main.we
Decision evidence
public snapshotAI called this Malicious at 88.0% confidence as Malware with low false-positive risk.
Evidence for block
- Facebook.node.js runs an async IIFE at module load that awaits the obfuscated init export.
- init.js loads fs, os, zlib, and proxy agents, then assigns fs, path, and os onto global before any wasm run.
- The init routine instantiates wasmBuffer with a Go WebAssembly runtime.
- dist/we.js is the Go host bridge and registers syscall/js handlers.
- package.json ships dist/main.we and dist/we.js, and init.js builds a file name ending in we.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- No plaintext external URL appears in the JavaScript; the fetch target stays inside obfuscated strings or the binary.
Behavioral surface
DynamicRequireFilesystem
HighEntropyStringsMinifiedObfuscated
WildcardDependency
Source & flagged code
6 flagged · loading sourcedist/nodes/Meta/Facebook.node.jsView file
1'use strict';const _0x491907=_0x3f92;(function(_0x43bd62,_0x5abb14){const _0x5a7a17=_0x3f92,_0xf28adf=_0x43bd62();while(!![]){try{const _0x217d5b=parseInt(_0x5a7a17(0x1b3e))/0x1+pa...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/nodes/Meta/Facebook.node.jsView on unpkg · L11}((async()=>{const _0x4341cc=_0x491907,_0x5573f9=_0xca96aa;await(0x1127+-0xa70*0x1+-0x3*0x23d,init_1[_0x5573f9(0x19be,_0x4341cc(0x1533))+_0x5573f9(0x1c18,_0x434
High
Ai Review Evidence
Facebook.node.js runs an async IIFE at module load that awaits the obfuscated init export.
dist/nodes/Meta/Facebook.node.jsView on unpkg · L11'use strict';const _0x491907=_0x3f92;(function(_0x43bd62,_0x5abb14){const _0x5a7a17=_0x3f92,_0xf28adf=_0x43bd62();while(!![]){try{const _0x217d5b=parseInt(_0x5a7a17(0x1b3e))/0x1+pa...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/nodes/Meta/Facebook.node.jsFindings
5 High4 Medium3 Low
HighObfuscated Payload Loaderdist/nodes/Meta/Facebook.node.js
HighObfuscated
HighAi Review Evidencedist/nodes/Meta/Facebook.node.js
HighAi Review Evidencedist/utils/init.js
HighAi Review Evidencedist/utils/init.js
MediumDynamic Requiredist/nodes/Meta/Facebook.node.js
MediumShips Wasm Moduledist/main.we
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to n8n-nodes-social-facebook@0.2.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing n8n-nodes-social-facebook@0.2.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.