T08 · Insecure Dependencies
Error
- Location
- nodes.md:113
- Finding
- Unverified Community Node Installation in the Live n8n Container## Vulnerability Details **File Location**: `nodes.md`, lines 113–119 **Additional Locations**: `SKILL.md`, lines 629 and 678 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: High ### Vulnerable Code ```markdown ## Community Nodes Install via `npm install` in n8n container: ```bash docker exec n8n npm install n8n-nodes-PACKAGE_NAME docker restart n8n ``` Browse available: https://www.npmjs.com/search?q=n8n-nodes ``` The same unsafe installation pattern is also presented in `SKILL.md`: ```markdown | Install community nodes | ❌ | `npm install` in container + restart | ``` ```markdown | Install community node | `docker exec n8n npm install n8n-nodes-NAME && docker restart n8n` | ``` ### Technical Analysis The instructions permit an unrestricted package name and do not require an exact version, lockfile, integrity hash, trusted-package allowlist, provenance verification, or package review. Installation occurs directly inside the running n8n application container. npm packages can execute lifecycle scripts such as `preinstall`, `install`, and `postinstall`. Consequently, installing a malicious, typo-squatted, compromised, or unexpectedly updated community package can execute attacker-controlled code with the permissions of the container user. The package could also provide malicious n8n node implementations that execute when workflows load or invoke them. Restarting the live container immediately after installation makes the newly installed component part of the active automation environment without an isolated build, security scan, or staged validation process. ### Attack Path 1. An attacker publishes a malicious or typo-squatted package using a plausible `n8n-nodes-*` name, or compromises an existing community package. 2. The attacker recommends that package for an integration needed by the user. 3. The agent or operator follows the documented command and substitutes the attacker-controlled package name: ```bash docker exec n ...[truncated 1387 chars]
- Remediation
- ## Remediation Suggestions 1. **Use an explicit allowlist** - Permit only reviewed package names from verified publishers. - Reject arbitrary package names supplied through workflow input or untrusted recommendations. 2. **Pin and verify dependencies** - Require exact package versions rather than floating versions. - Use a lockfile and verify registry integrity metadata. - Review package ownership, release history, source repository, signatures or provenance, and transitive dependencies before approval. 3. **Do not modify the live container** - Install approved nodes during an isolated image-build stage. - Scan the resulting image and dependencies before deployment. - Promote an immutable, versioned image through development, staging, and production. - Roll back by redeploying the previous image rather than editing a running container. 4. **Control lifecycle scripts** - Use `npm install --ignore-scripts` during initial inspection where compatible. - Audit any package that requires lifecycle scripts before allowing those scripts to execute. - Run software composition analysis and malware scanning against the package and resulting image. 5. **Apply runtime least privilege** - Run n8n as a non-root user. - Remove unnecessary Linux capabilities. - Use read-only filesystems and narrowly scoped writable volumes where feasible. - Never mount the Docker socket into the n8n container. - Restrict outbound network access and isolate sensitive internal services. 6. **Require explicit confirmation and staged testing** - Display the exact package, version, publisher, integrity value, and requested change before installation. - Require operator approval. - Test community nodes with non-production credentials and data in an isolated environment before production promotion. 7. **Replace the documented command** - Remove guidance that runs an unpinned `npm install` directly in the active container. - Provide a c ...[truncated 82 chars]