registry / @origami-hub/node-red-origami-grpc / 1.2.7

@origami-hub/node-red-origami-grpc@1.2.7

gRpc Wrapper for NodeRed

AI Security Review

scanned 20h ago · by lpm-firewall-ai

A runtime grpc-call node disables Node TLS verification globally, enabling interception of subsequent TLS connections. No install-time attack behavior is present.

Static reason

No blocking static signals were detected.

Trigger

A Node-RED flow sends input to a grpc-call node.

Impact

A network attacker may impersonate a configured TLS gRPC endpoint or affect other TLS requests in the Node-RED process.

Mechanism

gRPC client connection with unconditional global TLS-verification disablement

Rationale

The package is not malicious by source intent, but its unconditional process-wide TLS verification bypass is a material runtime security vulnerability. It should warn rather than block publication.

Evidence

package.jsongrpc/grpc-call.jsgrpc/grpc-server.jsgrpc/grpc-client-streaming.jsutils/utils.js

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Critical Vulnerability with medium false-positive risk.

Evidence for warning

grpc/grpc-call.js unconditionally sets NODE_TLS_REJECT_UNAUTHORIZED=0 on input.
That process-wide setting disables TLS certificate verification beyond the configured bypass option.

@origami-hub/node-red-origami-grpc@1.2.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code