n8n-nodes-mcp@0.1.37
CAUTIONPublisher claims: "MCP nodes for n8n " Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher nerding-io · joined 0 days agoInstalls 137KLast detonated 2 h ago
Behavior trace
Honeypot run · 3 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
2.4sprocessdependency install exit 1
2.5sprocessexec /usr/bin/timeout
2.5sprocessexited 1: Node.js v22.23.4
2.5sclaimedno tools/list reply (exit 1)
2.5sprocessscript backend runs setup only
Static findings
CRITICAL
Access to sensitive file pathsdist/nodes/McpClient/McpClient.node.js:354 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsdist/credentials/McpClientApi.credentials.js:39 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsdist/credentials/McpClientHttpApi.credentials.js:44 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsdist/nodes/McpClient/McpClient.node.js:356 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsdist/package.json:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsREADME.md:292 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsdist/nodes/McpClient/McpClient.node.js:339 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsdist/package.json:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsdist/credentials/McpClientSseApi.credentials.js:44 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsdist/nodes/McpClient/McpClient.node.js:353 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsdist/nodes/McpClient/McpClient.node.js:337 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathspackage.json:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsdist/package.json:42 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsindex.js:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsindex.js:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathspackage.json:42 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathsindex.js:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05CRITICAL
Access to sensitive file pathspackage.json:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05