@sirrlock/n8n-nodes-sirr

AI Security Review

Evidence context: threat category none; evidence quality strong.

This n8n node package for Sirr ephemeral secret management shows no evidence of malicious behavior. The 71 total findings are entirely explainable as scanner noise and false positives.

Tool Poisoning Assessment: The package has 0 tool-poisoning findings. This is the defining threat for MCP/agent packages, and its absence is significant. There are no hidden AI directives, no XML-style instruction tags, and no suspicious tool descriptions that would indicate tool poisoning.

Credential Access: The scanner detected 0 secret findings and 0 credential-access findings. The package reads no sensitive paths (.ssh, .aws, .kube) and has no evidence of credential harvesting. The code-smell findings (17 total) are low-severity noise from generic patterns.

Network Activity: The 3 network findings are all in test files, specifically package/dist/nodes/Sirr/Sirr.node.e2e.test.js:64 (NET-FETCH), not production code. The only domain detected is sirrlock.com (XIOC-DOMAIN-sirrlock.com), which is the legitimate service domain for this package.

IOC False Positives: The 51 IOC findings are clearly scanner noise from known false-positive patterns:

• File extensions misread as domains: sirr.node.test.d.ts.map (XIOC-DOMAIN-sirr.node.test.d.ts.map), sirr.node.test.js.map (XIOC-DOMAIN-sirr.node.test.js.map)
• Badge URLs: img.shields.io (XIOC-URL-https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)) - legitimate badge service
• Placeholder domains: example.com (XIOC-DOMAIN-example.com), sirr.example.com (XIOC-URL-https://sirr.example.com',)
• Property access chains: body.events (XIOC-DOMAIN-body.events), principal.me (XIOC-DOMAIN-principal.me)
• Email address: [email protected] ([email protected])

Strongest Counterargument: The high finding count (71) and "GitHub Actions" developer name could suggest automated/malicious publishing. However, the findings themselves contain no malicious patterns—no credential theft, no suspicious domains, no tool poisoning. The developer name "GitHub Actions" is common for automated CI/CD publishing and doesn't indicate malice.

Conclusion: This package is a legitimate n8n node for Sirr secret management with no evidence of malicious behavior. All findings are false positives from known scanner noise patterns.

Key Reasons

• Zero tool-poisoning findings (defining MCP threat absent)
• Zero secret/credential-access findings
• All IOC findings are false positives from file extensions, badge URLs, and property access chains
• Network activity only in test files (e2e.test.js)
• Only legitimate domain detected: sirrlock.com

False Positive Considerations

• File extensions misread as domains (.map files)
• Badge URLs from img.shields.io
• Property access chains (body.events, principal.me)
• Placeholder domains (example.com)

Reviewed 2026-04-27; recommended action: suppress false positive; model confidence 85%.