
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
n8n-nodes-dcc
Advanced tools
n8n community nodes for interacting with DecentralChain (DCC) node REST API (accounts, tokens, transactions, utilities).

Production readiness: early 0.x; expect breaking changes until 1.0. Follow semver guidance below.
The DCC Node REST API offers the ability to read blockchain data such as account data, token data, active leases, blocks, transactions, and other data including feature activation status and block reward voting status. It also provides transaction management functions like broadcasting signed transactions, pre-validating and checking transaction status. Additionally, it offers utilities for generating addresses from public keys, validating addresses, generating random seeds, calculating hashes, and more.
With this N8N you will be able to connect the DCC node api to your workflows, automate blockchain tasks or trigger wallet creations and more.
Install the community package in your n8n instance (requires enabling Community Nodes):
npm install n8n-nodes-dcc
Restart n8n after installation so it loads the new node bundle.
n8n-nodes-dcc if using the in-app installer or install via CLI as above.npm update n8n-nodes-dcc
Check changelog and commit history for potential breaking changes (0.x minor bumps may be breaking until 1.0.0).
This project follows Semantic Versioning principles; however while in 0.x the API surface (parameters, field names) may change in minor releases. Once 1.0.0 is reached:
Pin exact versions in mission‑critical environments to avoid unexpected changes.
CHANGELOG.md with changes.package.json following SemVer guidance.chore(release): vX.Y.Z.git tag -a vX.Y.Z -m "vX.Y.Z" then git push --tags.See detailed steps in CONTRIBUTING.md.
Resources supported:
The node can operate with or without credentials.
DccApi to centrally manage the Node Base URL and/or include a bearer token for authenticated endpoints (future expansion).DccMatcherApi to centrally manage the Matcher Base URL and API token. This is separate from the node API and is used only for the Matcher resource.Credential fields:
| Field | Description |
|---|---|
| Base URL | Optional override of default public node endpoint |
| Token | Bearer token (if your node requires auth) |
Matcher credential (DccMatcherApi) fields:
| Field | Description |
|---|---|
| Base URL | Matcher endpoint, e.g. https://mainnet-matcher.decentralchain.io |
| Token | Bearer token used by your matcher instance (if required) |
If no credential is supplied, the node uses the Base URL parameter on the node itself.
DCC for the native asset).Notes:
DccMatcherApi credential when provided; otherwise the node uses the "Matcher Base URL" field on the node.Install dependencies and build:
npm install
npm run build
npm run check:dist
Lint & format:
npm run lint
npm run lintfix
npm run format
You need the following installed on your development machine:
Refer to our documentation to get more background on how the DCC node works: DecentralChain Documentation
Issues & PRs welcome. Please open security-related issues with the SECURITY prefix (see Security Policy).
FAQs
n8n community nodes for interacting with DecentralChain (DCC) node REST API (accounts, tokens, transactions, utilities).
We found that n8n-nodes-dcc demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.