@n8n/api-types

AI Security Review

Evidence context: threat category none; evidence quality weak.

@n8n/api-types 1.43.5 is a declaration package: TypeScript types and schema definitions for n8n's internal API, shared between the backend and the frontend. The publisher string is GitHub Actions, which matches n8n's automated release pipeline for its scoped packages. There is no server, no transport, no tool registration and no executable entry point. Every threat in the MCP and agent category assumes code that runs during a session, and this package has none.

On tool poisoning, the scan reported no matches in that category. That is the expected result for a package with no tool descriptions to inspect. Genuine tool poisoning lives in directives aimed at the model, phrasing that tells it to run something silently or hide an action from the user. There is no tool metadata here for such a directive to hide in, and no tool schema file was flagged.

On credentials and network, nothing reads process.env and nothing touches the paths that matter for credential theft: .ssh, .aws/credentials, .kube/config or application_default_credentials.json. No network endpoints were extracted, and the package declares no permissions and no host permissions. Exfiltration needs two halves, a harvest and a destination. Neither half is present.

Shadow behaviour is ruled out the same way. A .d.ts file carries type declarations, so there is no function body to hide a second action inside, and no file path in the package points at anything a tool would call at runtime.

One further check: version 1.43.5 tracks n8n's own release numbering and @n8n/api-types is the scoped name n8n actually publishes, so the typosquatting and name-squatting patterns do not apply here.

The strongest counterargument is that a zero across every category can mean the scanner had nothing to inspect rather than that the package is clean. A published npm tarball usually drags in some indicator noise from build output, so exactly zero for IoC, malware signature and obfuscation is a little unusual. Two things keep that from changing the conclusion. First, a types-only package produces almost no runtime JavaScript, so signature and indicator scanners have nothing to match on, which makes a real absence and a shallow scan look identical. Second, even a malicious update would have to add an executable entry point before it could reach an agent session, and that file would show up on the next scan of the tarball.

What this package cannot do is act. It defines shapes for data that other n8n code moves around. Judged on the files described, there is no capability here to poison a tool call, read a secret, or send one anywhere.

Key Reasons

• Zero findings in every category including tool-poisoning, credential-access, network and obfuscation
• Package is declaration-only TypeScript types for n8n's internal API, with no runtime entry point, transport or tool registration
• No permissions, host permissions or network endpoints declared anywhere in the manifest
• No reads of credential paths such as .ssh, .aws/credentials or .kube/config, and no process.env harvesting
• Scoped name and GitHub Actions publisher match n8n's real release pipeline, ruling out typosquatting

False Positive Considerations

• Types-only package produces no runtime code for signature or IoC scanners to match
• Empty findings across all scanner categories can reflect a thin scan rather than a clean package
• No tool schema or description files exist to trigger tool-poisoning heuristics

Reviewed 2026-10-18; recommended action: no action; model confidence 70%.