registry / @tpsdev-ai/n8n-nodes-flair / 0.18.0

@tpsdev-ai/n8n-nodes-flair@0.18.0

n8n community node — use Flair as your AI Agent's memory backend. Includes FlairChatMemory (Memory port) and FlairSearch (Tool port).

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

Eval

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 25.9 KB of source, external domains: github.com

Source & flagged code

2 flagged

dist/credentials/FlairApi.credentials.jsView file

Lines 48-80javascript

48 name: 'adminPassword',

49 type: 'string',

50 typeOptions: { password: true },

51 default: '',

52 required: true,

53 description: "Flair (Harper) admin password. Sensitive: grants read/write to the entire instance. Use Ed25519 per-agent auth (planned) for production with untrusted workflow inputs.",

54 },

55 ];

56 authenticate = {

57 type: 'generic',

58 // Use n8n's built-in HTTP Basic auth handling — it base64-encodes

59 // username:password internally. Avoids relying on Buffer being in n8n's

60 // expression sandbox (it isn't always, depending on n8n version).

61 // Earlier the credential used a custom expression with `Buffer.from(...)`

62 // which silently produced an empty Authorization header on installs

63 // where Buffer wasn't whitelisted in the expression engine, causing

64 // "Authorization failed" with valid credentials (2026-05-11 incident).

65 properties: {

66 auth: {

67 username: 'admin',

68 password: '={{ $credentials.adminPassword }}',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/credentials/FlairApi.credentials.jsView on unpkg · L68

69 },

70 },

71 };

72 test = {

73 request: {

74 baseURL: '={{ $credentials.baseUrl }}',

75 url: '/Memory',

76 },

77 };

78}

79exports.FlairApi = FlairApi;

dist/nodes/FlairChatMemory/FlairChatMemory.node.jsView file

Lines 54-94javascript

54 default: "",

55 description: "Optional sub-scope appended to the subject as `<subject>:<sessionKey>`. Use the n8n execution id (`={{ $execution.id }}`) for per-run isolation, or leave blank to share memory across runs.",

56 },

57 {

58 displayName: "Context Window Length",

59 name: "contextWindowLength",

Source & flagged code

2 flagged · loading source

dist/credentials/FlairApi.credentials.jsView file

68patternName = generic_password severity = medium line = 68 matchedText = password...}}',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/credentials/FlairApi.credentials.jsView on unpkg · L68

dist/nodes/FlairChatMemory/FlairChatMemory.node.jsView file

74// module: "CommonJS"). L75: const flairMod = await new Function("return import('@tpsdev-ai/flair-client')")(); L76: const flair = new flairMod.FlairClient({

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/nodes/FlairChatMemory/FlairChatMemory.node.jsView on unpkg · L74

Findings

1 Medium5 Low

MediumSecret Patterndist/credentials/FlairApi.credentials.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/nodes/FlairChatMemory/FlairChatMemory.node.js

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/credentials/FlairApi.credentials.jsView file

Lines 48-80javascript

48 name: 'adminPassword',

49 type: 'string',

50 typeOptions: { password: true },

51 default: '',

52 required: true,

53 description: "Flair (Harper) admin password. Sensitive: grants read/write to the entire instance. Use Ed25519 per-agent auth (planned) for production with untrusted workflow inputs.",

54 },

55 ];

56 authenticate = {

57 type: 'generic',

58 // Use n8n's built-in HTTP Basic auth handling — it base64-encodes

59 // username:password internally. Avoids relying on Buffer being in n8n's

60 // expression sandbox (it isn't always, depending on n8n version).

61 // Earlier the credential used a custom expression with `Buffer.from(...)`

62 // which silently produced an empty Authorization header on installs

63 // where Buffer wasn't whitelisted in the expression engine, causing

64 // "Authorization failed" with valid credentials (2026-05-11 incident).

65 properties: {

66 auth: {

67 username: 'admin',

68 password: '={{ $credentials.adminPassword }}',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/credentials/FlairApi.credentials.jsView on unpkg · L68

69 },

70 },

71 };

72 test = {

73 request: {

74 baseURL: '={{ $credentials.baseUrl }}',

75 url: '/Memory',

76 },

77 };

78}

79exports.FlairApi = FlairApi;

dist/nodes/FlairChatMemory/FlairChatMemory.node.jsView file

Lines 54-94javascript

54 default: "",

56 },

57 {

58 displayName: "Context Window Length",

59 name: "contextWindowLength",