n8n-nodes-apidirect

AI Security Review

Evidence context: threat category none; evidence quality moderate.

n8n-nodes-apidirect is an n8n community node that connects a workflow to the API Direct service. The package describes that service as a search and monitoring tool for social media, news, and the web across Twitter/X, Facebook, Instagram, TikTok, YouTube, Reddit, Threads, Truth Social, and Google. Version 0.8.0 declares no host permissions and no permissions, and the scan recorded zero tool-poisoning findings, zero credential-access findings, zero secret findings, and zero malware signatures.

Tool poisoning: nothing matched. The scanner found no hidden-instruction patterns in any node or tool description, and no invisible-character manipulation. Tool poisoning is the defining risk for agent-facing packages, so the absence of any signal here is the first thing that matters. The descriptions name social surfaces, they do not issue commands to an AI.

The 12 network findings are all NET-FETCH entries inside dist/nodes/Apidirect/resources/facebook/, including groupPosts.js:56, pagePosts.js:69, searchPosts.js:82, and searchVideos.js:69. Every one sits in a resource module named after the exact Facebook surface the package says it covers. A node that fetches Facebook page posts has to call out to something, and these calls are the node doing the job it advertises. The endpoint list (bbc.com, trustpilot.com, tiktok.video, gossby.com, lenny.substack.com) reads like a mix of news, review, and video sites, which is what a search-and-monitor tool would reference. No call carries user data to an endpoint that does not match the product's subject matter.

Credential scope: none recorded. There are no reads of .ssh, .aws, .kube, or application_default_credentials.json, and no environment lookups aimed at specific token names. That absence is what breaks the exfiltration pattern. Exfiltration needs a harvest step and an exfil step. Without the harvest, the network calls have nothing secret to send.

The strongest counterargument to this verdict is the publisher string. "GitHub Actions" is an automated CI identity, and the recorded user count is zero, which is the profile that usually earns a second look. Two domains, gossby.com and lenny.substack.com, are also not obviously part of API Direct's infrastructure. Neither point survives the rest of the evidence. Publishing n8n community nodes from CI is routine, and the unusual domains fit a news-and-web search tool rather than a collection endpoint. A payload would leave a trace somewhere in this scan, and there is none: no credential reads, no environment lookups targeting secrets, no obfuscation finding, no malware signature.

The remaining volume is the documented noise. The 1360 IoC entries are string matches pulled from minified dist/ output, the same pattern that fires on nearly every package shipping a build folder. The 214 code-smell hits are low-severity rules that trigger on ordinary JavaScript. Neither bucket describes behavior, and neither moves the conclusion.

Key Reasons

• Zero tool-poisoning findings: no hidden AI directives or invisible-character manipulation in any node description.
• Zero credential, secret, and malware findings; no reads of .ssh, .aws, .kube or application default credentials, so the harvest half of an exfiltration pattern is absent.
• The 12 NET-FETCH calls (e.g. dist/nodes/Apidirect/resources/facebook/pagePosts.js:69) sit in resource modules named after the Facebook surfaces the node advertises, matching its stated purpose.
• The 1360 IoC entries and 214 code-smell hits are documented noise from minified dist/ output and broad low-severity rules.
• No host permissions or permissions declared, and endpoint references (bbc.com, trustpilot.com, tiktok.video) match a news and web search tool.

False Positive Considerations

• IoC extractor noise: 1360 string matches from minified dist/ output
• YARA code-smell rules: 214 low-severity hits on ordinary JavaScript
• Bundled n8n node build output under dist/nodes/Apidirect/
• NET-FETCH findings are legitimate API calls for the node's declared Facebook search features

Reviewed 2026-10-16; recommended action: suppress false positive; model confidence 75%.