registry / n8n-mcp / 2.63.0

n8n-mcp@2.63.0

Integration between n8n workflow automation and Model Context Protocol (MCP)

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 213 file(s), 2.11 MB of source, external domains: api-staging.n8n.io, api.example.com, api.github.com, api.n8n.io, api.npmjs.org, docs.google.com, example.com, github.com, n8n-mcp.com, n8n.io, registry.npmjs.org, www.n8n-mcp.com, ydyufsohxdfpopqbubwk.supabase.co, your-api.com, your-n8n-instance.com, your-n8n.com

Source & flagged code

7 flagged

dist/telemetry/telemetry-types.jsView file

Lines 1-29javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.TelemetryErrorType = exports.TELEMETRY_BACKEND = exports.TELEMETRY_CONFIG = void 0;

4exports.TELEMETRY_CONFIG = {

5 BATCH_FLUSH_INTERVAL: 5000,

6 EVENT_QUEUE_THRESHOLD: 10,

7 WORKFLOW_QUEUE_THRESHOLD: 5,

8 MAX_RETRIES: 3,

9 RETRY_DELAY: 1000,

10 OPERATION_TIMEOUT: 5000,

11 RATE_LIMIT_WINDOW: 60000,

12 RATE_LIMIT_MAX_EVENTS: 100,

13 MAX_QUEUE_SIZE: 1000,

14 MAX_BATCH_SIZE: 50,

15};

16exports.TELEMETRY_BACKEND = {

17 URL: 'https://ydyufsohxdfpopqbubwk.supabase.co',

18 ANON_KEY: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InlkeXVmc29oeGRmcG9wcWJ1YndrIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTg3OTYyMDAsImV4cCI6MjA3NDM3MjIwMH0.xESphg6h5ozaDsm4Vla3QnDJGc6Nc_cpfoqTHRynkCk'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/telemetry/telemetry-types.jsView on unpkg · L18

Critical

Secret Pattern

Supabase service role key (JWT) in dist/telemetry/telemetry-types.js

dist/telemetry/telemetry-types.jsView on unpkg · L18

19};

20var TelemetryErrorType;

21(function (TelemetryErrorType) {

22 TelemetryErrorType["VALIDATION_ERROR"] = "VALIDATION_ERROR";

23 TelemetryErrorType["NETWORK_ERROR"] = "NETWORK_ERROR";

24 TelemetryErrorType["RATE_LIMIT_ERROR"] = "RATE_LIMIT_ERROR";

25 TelemetryErrorType["QUEUE_OVERFLOW_ERROR"] = "QUEUE_OVERFLOW_ERROR";

26 TelemetryErrorType["INITIALIZATION_ERROR"] = "INITIALIZATION_ERROR";

27 TelemetryErrorType["UNKNOWN_ERROR"] = "UNKNOWN_ERROR";

28})(TelemetryErrorType || (exports.TelemetryErrorType = TelemetryErrorType = {}));

29//# sourceMappingURL=telemetry-types.js.map

dist/services/node-specific-validators.jsView file

Lines 1495-1535javascript

1495 while ((match = filterPattern.exec(code)) !== null) {

1496 const number = match[1];

1497 const beforeNumber = code.substring(match.index, match.index + match[0].indexOf

dist/mcp-engine.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.N8NMCPEngine = void 0;

4const http_server_single_session_1 = require("./http-server-single-session");

5const logger_1

dist/utils/ssrf-protection.jsView file

Lines 1-27javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty

dist/scripts/rebuild-optimized.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = n8n-mcp@2.62.0 matchedIdentity = npm:bjhuLW1jcA:2.62.0 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/scripts/rebuild-optimized.jsView on unpkg

dist/telemetry/telemetry-types.d.tsView file

Lines 55-95typescript

55 nodeTypes: string[];

56 hasTrigger: boolean;

57 hasWebhook: boolean;

58 complexity: 'simple' | 'medium' | 'complex';

59 workflowHash: string;

60}

61export

Source & flagged code

7 flagged · loading source

dist/telemetry/telemetry-types.jsView file

18patternName = supabase_service_key severity = critical line = 18 matchedText = ANON_KEY...kCk'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/telemetry/telemetry-types.jsView on unpkg · L18

18patternName = supabase_service_key severity = critical line = 18 matchedText = ANON_KEY...kCk'

Critical

Secret Pattern

Supabase service role key (JWT) in dist/telemetry/telemetry-types.js

dist/telemetry/telemetry-types.jsView on unpkg · L18

dist/services/node-specific-validators.jsView file

1515const dangerousPatterns = [ L1516: { pattern: /(?<![.\w$])eval\s*\(/, message: 'Avoid eval() - it\'s a security risk' }, L1517: { pattern: /(?<![.\w$])Function\s*\(/, message: 'Avoid Function constructor - use regular functions' },

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/services/node-specific-validators.jsView on unpkg · L1515

dist/mcp-engine.jsView file

3exports.N8NMCPEngine = void 0; L4: const http_server_single_session_1 = require("./http-server-single-session"); L5: const logger_1 = require("./utils/logger");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/mcp-engine.jsView on unpkg · L3

dist/utils/ssrf-protection.jsView file

7const url_1 = require("url"); L8: const promises_1 = require("dns/promises"); L9: const net_1 = require("net"); ... L28: ]); L29: const PRIVATE_IP_RANGES = [ L30: /^10\./, ... L106: const url = new url_1.URL(urlString); L107: const mode = (process.env.WEBHOOK_SECURITY_MODE || 'strict'); L108: if (!['http:', 'https:'].includes(url.protocol)) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/utils/ssrf-protection.jsView on unpkg · L7

dist/scripts/rebuild-optimized.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/scripts/rebuild-optimized.jsView on unpkg

dist/telemetry/telemetry-types.d.tsView file

75patternName = supabase_service_key severity = critical line = 75 matchedText = readonly...Ck";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/telemetry/telemetry-types.d.ts

dist/telemetry/telemetry-types.d.tsView on unpkg · L75

Findings

3 Critical2 High4 Medium4 Low

CriticalCritical Secretdist/telemetry/telemetry-types.js

CriticalSecret Patterndist/telemetry/telemetry-types.js

CriticalSecret Patterndist/telemetry/telemetry-types.d.ts

HighCloud Metadata Accessdist/utils/ssrf-protection.js

HighPrevious Version Dangerous Deltadist/scripts/rebuild-optimized.js

MediumDynamic Requiredist/mcp-engine.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowEvaldist/services/node-specific-validators.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/telemetry/telemetry-types.jsView file

Lines 1-29javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.TelemetryErrorType = exports.TELEMETRY_BACKEND = exports.TELEMETRY_CONFIG = void 0;

4exports.TELEMETRY_CONFIG = {

5 BATCH_FLUSH_INTERVAL: 5000,

6 EVENT_QUEUE_THRESHOLD: 10,

7 WORKFLOW_QUEUE_THRESHOLD: 5,

8 MAX_RETRIES: 3,

9 RETRY_DELAY: 1000,

10 OPERATION_TIMEOUT: 5000,

11 RATE_LIMIT_WINDOW: 60000,

12 RATE_LIMIT_MAX_EVENTS: 100,

13 MAX_QUEUE_SIZE: 1000,

14 MAX_BATCH_SIZE: 50,

15};

16exports.TELEMETRY_BACKEND = {

17 URL: 'https://ydyufsohxdfpopqbubwk.supabase.co',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/telemetry/telemetry-types.jsView on unpkg · L18

Critical

Secret Pattern

Supabase service role key (JWT) in dist/telemetry/telemetry-types.js

dist/telemetry/telemetry-types.jsView on unpkg · L18

19};

20var TelemetryErrorType;

21(function (TelemetryErrorType) {

22 TelemetryErrorType["VALIDATION_ERROR"] = "VALIDATION_ERROR";

23 TelemetryErrorType["NETWORK_ERROR"] = "NETWORK_ERROR";

24 TelemetryErrorType["RATE_LIMIT_ERROR"] = "RATE_LIMIT_ERROR";

25 TelemetryErrorType["QUEUE_OVERFLOW_ERROR"] = "QUEUE_OVERFLOW_ERROR";

26 TelemetryErrorType["INITIALIZATION_ERROR"] = "INITIALIZATION_ERROR";

27 TelemetryErrorType["UNKNOWN_ERROR"] = "UNKNOWN_ERROR";

28})(TelemetryErrorType || (exports.TelemetryErrorType = TelemetryErrorType = {}));

29//# sourceMappingURL=telemetry-types.js.map

dist/services/node-specific-validators.jsView file

Lines 1495-1535javascript

1495 while ((match = filterPattern.exec(code)) !== null) {

1496 const number = match[1];

1497 const beforeNumber = code.substring(match.index, match.index + match[0].indexOf

dist/mcp-engine.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.N8NMCPEngine = void 0;

4const http_server_single_session_1 = require("./http-server-single-session");

5const logger_1

dist/utils/ssrf-protection.jsView file

Lines 1-27javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty

dist/scripts/rebuild-optimized.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/scripts/rebuild-optimized.jsView on unpkg

dist/telemetry/telemetry-types.d.tsView file

Lines 55-95typescript

55 nodeTypes: string[];

56 hasTrigger: boolean;

57 hasWebhook: boolean;

58 complexity: 'simple' | 'medium' | 'complex';

59 workflowHash: string;

60}

61export