Is "@inrupt/solid-client-authn-node" on n8n Safe to Install?

GitHub Actions · n8n · v3.1.1

`solid-client-authn-node` is a library designed to authenticate Node.js apps (both scripts and full-blown Web servers) with Solid identity servers. The main documentation is at the [root of the repository](https://github.com/inrupt/solid-client-authn-js).

Risk Assessment

Analyzed
100
out of 100
CRITICAL

334 security findings detected across all analyzers

Severity Breakdown

0
Critical
0
High
188
Medium
146
Low
0
Info

Finding Categories

21
Network
152
IoC Indicators

YARA Rules Matched

9 rules(142 hits)
postinstall network communication postinstall file download postinstall crypto operations postinstall file manipulation credential generic tokens RedirectToUnknownPath postinstall environment access postinstall obfuscation CreatingCookiesWithoutTheSecureFlag

About This Extension

`solid-client-authn-node` is a library designed to authenticate Node.js apps (both scripts and full-blown Web servers) with Solid identity servers. The main documentation is at the [root of the repository](https://github.com/inrupt/solid-client-authn-js).

Detailed Findings

167 total

YARA Rule Matches

9 rules

Indicators of Compromise

Network indicators, suspicious strings, and potential IoCs extracted during analysis

URLs
98
IP Addresses
1
Domains
55
Strings
152

All Indicators · 152

Domain
detected Domain: openid.net

XIOC detected Domain: openid.net

extracted_from_files

Domain
detected Domain: example.com

XIOC detected Domain: example.com

extracted_from_files

URL
detected URL: https://github.com/inrupt/solid-client-authn-js.git

XIOC detected URL: https://github.com/inrupt/solid-client-authn-js.git

extracted_from_files

Domain
detected Domain: developer.mozilla.org

XIOC detected Domain: developer.mozilla.org

extracted_from_files

Domain
detected Domain: pod.example.com

XIOC detected Domain: pod.example.com

extracted_from_files

Domain
detected Domain: inrupt.atlassian.net

XIOC detected Domain: inrupt.atlassian.net

extracted_from_files

Domain
detected Domain: forum.solidproject.org

XIOC detected Domain: forum.solidproject.org

extracted_from_files

Domain
detected Domain: docs.inrupt.com

XIOC detected Domain: docs.inrupt.com

extracted_from_files

Domain
detected Domain: www.npmjs.com

XIOC detected Domain: www.npmjs.com

extracted_from_files

Domain
detected Domain: github.com

XIOC detected Domain: github.com

extracted_from_files

Domain
detected Domain: openidclient.issuer.discover

XIOC detected Domain: openidclient.issuer.discover

extracted_from_files

Domain
detected Domain: metadata.id

XIOC detected Domain: metadata.id

extracted_from_files

IP
detected IP: ::

XIOC detected IP: ::

extracted_from_files

URL
detected URL: https://my.idp/logout

XIOC detected URL: https://my.idp/logout

extracted_from_files

URL
detected URL: https://my-app.com/logged-out

XIOC detected URL: https://my-app.com/logged-out

extracted_from_files

URL
detected URL: https://zoomies.com/commanderCool#me

XIOC detected URL: https://zoomies.com/commanderCool#me

extracted_from_files

URL
detected URL: https://some.idp/

XIOC detected URL: https://some.idp/

extracted_from_files

URL
detected URL: https://example.com/profile#me

XIOC detected URL: https://example.com/profile#me

extracted_from_files

URL
detected URL: https://my.pod/resource

XIOC detected URL: https://my.pod/resource

extracted_from_files

URL
detected URL: https://example.com]

XIOC detected URL: https://example.com]

extracted_from_files

URL
detected URL: https://my.idp

XIOC detected URL: https://my.idp

extracted_from_files

URL
detected URL: https://some.issuer/autorization

XIOC detected URL: https://some.issuer/autorization

extracted_from_files

URL
detected URL: https://some.issuer/token

XIOC detected URL: https://some.issuer/token

extracted_from_files

URL
detected URL: https://some.issuer/keys

XIOC detected URL: https://some.issuer/keys

extracted_from_files

URL
detected URL: https://some.issuer/registration

XIOC detected URL: https://some.issuer/registration

extracted_from_files

URL
detected URL: https://my.app/redirect?code=someCode&state=someState&iss=https://example.org/issuer

XIOC detected URL: https://my.app/redirect?code=someCode&state=someState&iss=https://example.org/issuer

extracted_from_files

URL
detected URL: https://my.app/redirect?code=someCode&state=someState&iss=someIssuer

XIOC detected URL: https://my.app/redirect?code=someCode&state=someState&iss=someIssuer

extracted_from_files

URL
detected URL: https://coolparty.com/

XIOC detected URL: https://coolparty.com/

extracted_from_files

URL
detected URL: https://coolparty.com/?test=test

XIOC detected URL: https://coolparty.com/?test=test

extracted_from_files

URL
detected URL: https://my.app

XIOC detected URL: https://my.app

extracted_from_files

URL
detected URL: https://my.webid/

XIOC detected URL: https://my.webid/

extracted_from_files

URL
detected URL: https://some.pod/resource

XIOC detected URL: https://some.pod/resource

extracted_from_files

URL
detected URL: https://coolparty.com/?state=someState

XIOC detected URL: https://coolparty.com/?state=someState

extracted_from_files

URL
detected URL: https://coolparty.com/?code=someCode

XIOC detected URL: https://coolparty.com/?code=someCode

extracted_from_files

URL
detected URL: https://some.client#id

XIOC detected URL: https://some.client#id

extracted_from_files

URL
detected URL: https://my.app]:

XIOC detected URL: https://my.app]:

extracted_from_files

URL
detected URL: https://my.app/redirect?code=someCode&state=someState

XIOC detected URL: https://my.app/redirect?code=someCode&state=someState

extracted_from_files

URL
detected URL: https://some.client.identifier

XIOC detected URL: https://some.client.identifier

extracted_from_files

URL
detected URL: https://idp.com/token

XIOC detected URL: https://idp.com/token

extracted_from_files

URL
detected URL: https://idp.com/jwks

XIOC detected URL: https://idp.com/jwks

extracted_from_files

Domain
detected Domain: my-app.com

XIOC detected Domain: my-app.com

extracted_from_files

URL
detected URL: https://resource.example.org

XIOC detected URL: https://resource.example.org

extracted_from_files

URL
detected URL: https://coolparty.com/?code=someCode&state=oauth2_state_value

XIOC detected URL: https://coolparty.com/?code=someCode&state=oauth2_state_value

extracted_from_files

URL
detected URL: https://coolparty.com/?meep=mop

XIOC detected URL: https://coolparty.com/?meep=mop

extracted_from_files

URL
detected URL: https://my.app/redirect

XIOC detected URL: https://my.app/redirect

extracted_from_files

URL
detected URL: https://app.example.com

XIOC detected URL: https://app.example.com

extracted_from_files

URL
detected URL: https://example.com/auth

XIOC detected URL: https://example.com/auth

extracted_from_files

URL
detected URL: https://example.com/token

XIOC detected URL: https://example.com/token

extracted_from_files

URL
detected URL: https://example.com/jwks

XIOC detected URL: https://example.com/jwks

extracted_from_files

URL
detected URL: https://example.com/end-session

XIOC detected URL: https://example.com/end-session

extracted_from_files

URL
detected URL: https://idp.com/auth

XIOC detected URL: https://idp.com/auth

extracted_from_files

URL
detected URL: https://my.app/registration#app

XIOC detected URL: https://my.app/registration#app

extracted_from_files

URL
detected URL: https://some.issuer/

XIOC detected URL: https://some.issuer/

extracted_from_files

URL
detected URL: https://someUrl.com/redirect

XIOC detected URL: https://someUrl.com/redirect

extracted_from_files

URL
detected URL: https://jackson.solid.community/profile/card#me

XIOC detected URL: https://jackson.solid.community/profile/card#me

extracted_from_files

URL
detected URL: https://example.org/some-redirect-url

XIOC detected URL: https://example.org/some-redirect-url

extracted_from_files

URL
detected URL: https://example.com

XIOC detected URL: https://example.com

extracted_from_files

URL
detected URL: https://my.idp/

XIOC detected URL: https://my.idp/

extracted_from_files

URL
detected URL: https://arbitrary.url

XIOC detected URL: https://arbitrary.url

extracted_from_files

URL
detected URL: https://app.com/redirect

XIOC detected URL: https://app.com/redirect

extracted_from_files

URL
detected URL: https://rp.example.org/client-id

XIOC detected URL: https://rp.example.org/client-id

extracted_from_files

URL
detected URL: https://rp.example.org/callback/

XIOC detected URL: https://rp.example.org/callback/

extracted_from_files

URL
detected URL: https://some.resource

XIOC detected URL: https://some.resource

extracted_from_files

URL
detected URL: https://example.org/callback/

XIOC detected URL: https://example.org/callback/

extracted_from_files

URL
detected URL: https://some.issuer/uri_parameters_go_there/

XIOC detected URL: https://some.issuer/uri_parameters_go_there/

extracted_from_files

URL
detected URL: https://some.issuer

XIOC detected URL: https://some.issuer

extracted_from_files

URL
detected URL: https://my.idp/auth

XIOC detected URL: https://my.idp/auth

extracted_from_files

URL
detected URL: https://my.idp/token

XIOC detected URL: https://my.idp/token

extracted_from_files

URL
detected URL: https://my.idp/register

XIOC detected URL: https://my.idp/register

extracted_from_files

URL
detected URL: https://my.idp/jwks

XIOC detected URL: https://my.idp/jwks

extracted_from_files

URL
detected URL: https://my.idp/endSessionEndpoint

XIOC detected URL: https://my.idp/endSessionEndpoint

extracted_from_files

URL
detected URL: https://some.idp

XIOC detected URL: https://some.idp

extracted_from_files

URL
detected URL: https://some.webid

XIOC detected URL: https://some.webid

extracted_from_files

URL
detected URL: https://pod.com/profile/card#me

XIOC detected URL: https://pod.com/profile/card#me

extracted_from_files

URL
detected URL: https://some.webid#them

XIOC detected URL: https://some.webid#them

extracted_from_files

URL
detected URL: https://my.app/?code=someCode&state=arizona

XIOC detected URL: https://my.app/?code=someCode&state=arizona

extracted_from_files

URL
detected URL: https://example.org

XIOC detected URL: https://example.org

extracted_from_files

URL
detected URL: https://html5zombo.com

XIOC detected URL: https://html5zombo.com

extracted_from_files

URL
detected URL: https://coolapp.com/redirect?state=userId&id_token=idToken&access_token=accessToken

XIOC detected URL: https://coolapp.com/redirect?state=userId&id_token=idToken&access_token=accessToken

extracted_from_files

Domain
detected Domain: metadata.claims

XIOC detected Domain: metadata.claims

extracted_from_files

URL
detected URL: https://openid.net/specs/openid-connect-registration-1_0.html

XIOC detected URL: https://openid.net/specs/openid-connect-registration-1_0.html

extracted_from_files

Domain
detected Domain: tools.ietf.org

XIOC detected Domain: tools.ietf.org

extracted_from_files

URL
detected URL: https://coolapp.com/redirect

XIOC detected URL: https://coolapp.com/redirect

extracted_from_files

URL
detected URL: https://idp.com

XIOC detected URL: https://idp.com

extracted_from_files

URL
detected URL: https://example.org/redirect#some-fragment

XIOC detected URL: https://example.org/redirect#some-fragment

extracted_from_files

URL
detected URL: https://example.org/redirect?state=1234

XIOC detected URL: https://example.org/redirect?state=1234

extracted_from_files

URL
detected URL: https://example.org/redirect?code=1234

XIOC detected URL: https://example.org/redirect?code=1234

extracted_from_files

URL
detected URL: https://docs.inrupt.com/ess/latest/security/authentication/#client-identifier-client-id).

XIOC detected URL: https://docs.inrupt.com/ess/latest/security/authentication/#client-identifier-client-id).

extracted_from_files

URL
detected URL: https://example.com/logout',

XIOC detected URL: https://example.com/logout',

extracted_from_files

URL
detected URL: https://openid.net/specs/openid-connect-discovery-1_0.html

XIOC detected URL: https://openid.net/specs/openid-connect-discovery-1_0.html

extracted_from_files

URL
detected URL: https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth

XIOC detected URL: https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth

extracted_from_files

URL
detected URL: https://tools.ietf.org/html/rfc7636

XIOC detected URL: https://tools.ietf.org/html/rfc7636

extracted_from_files

URL
detected URL: https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokens

XIOC detected URL: https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokens

extracted_from_files

URL
detected URL: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint

XIOC detected URL: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint

extracted_from_files

URL
detected URL: https://inrupt.atlassian.net/servicedesk).

XIOC detected URL: https://inrupt.atlassian.net/servicedesk).

extracted_from_files

URL
detected URL: https://github.com/nvm-sh/nvm)

XIOC detected URL: https://github.com/nvm-sh/nvm)

extracted_from_files

URL
detected URL: https://github.com/solid/node-solid-server/releases/tag/v5.3.0)

XIOC detected URL: https://github.com/solid/node-solid-server/releases/tag/v5.3.0)

extracted_from_files

URL
detected URL: https://docs.inrupt.com/)

XIOC detected URL: https://docs.inrupt.com/)

extracted_from_files

URL
detected URL: https://pod.example.com/private-resource

XIOC detected URL: https://pod.example.com/private-resource

extracted_from_files

URL
detected URL: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API).

XIOC detected URL: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API).

extracted_from_files

URL
detected URL: https://fetch.spec.whatwg.org/).

XIOC detected URL: https://fetch.spec.whatwg.org/).

extracted_from_files

URL
detected URL: https://github.com/panva/jose).

XIOC detected URL: https://github.com/panva/jose).

extracted_from_files

URL
detected URL: https://www.npmjs.com/package/@inrupt/solid-client-authn-node)is

XIOC detected URL: https://www.npmjs.com/package/@inrupt/solid-client-authn-node)is

extracted_from_files

URL
detected URL: https://docs.inrupt.com/client-libraries/solid-client-js/)

XIOC detected URL: https://docs.inrupt.com/client-libraries/solid-client-js/)

extracted_from_files

URL
detected URL: https://github.com/inrupt/solid-client-authn)

XIOC detected URL: https://github.com/inrupt/solid-client-authn)

extracted_from_files

URL
detected URL: https://github.com/inrupt/solid-common-vocab-rdf)

XIOC detected URL: https://github.com/inrupt/solid-common-vocab-rdf)

extracted_from_files

URL
detected URL: https://forum.solidproject.org/).

XIOC detected URL: https://forum.solidproject.org/).

extracted_from_files

URL
detected URL: https://github.com/inrupt/solid-client-authn/issues/).

XIOC detected URL: https://github.com/inrupt/solid-client-authn/issues/).

extracted_from_files

Domain
detected Domain: coolparty.com

XIOC detected Domain: coolparty.com

extracted_from_files

Domain
detected Domain: resource.example.org

XIOC detected Domain: resource.example.org

extracted_from_files

Domain
detected Domain: mockedtokens.id

XIOC detected Domain: mockedtokens.id

extracted_from_files

URL
detected URL: https://some.url

XIOC detected URL: https://some.url

extracted_from_files

URL
detected Domain: logouturl.host

XIOC detected Domain: logouturl.host

extracted_from_files

Domain
detected Domain: zoomies.com

XIOC detected Domain: zoomies.com

extracted_from_files

URL
detected URL: https://github.com/inrupt/solid-client-authn-js).

XIOC detected URL: https://github.com/inrupt/solid-client-authn-js).

extracted_from_files

Domain
detected Domain: mocks.storage

XIOC detected Domain: mocks.storage

extracted_from_files

Domain
detected Domain: defaultmocks.storage

XIOC detected Domain: defaultmocks.storage

extracted_from_files

Domain
detected Domain: mockedissuerconfig.claims

XIOC detected Domain: mockedissuerconfig.claims

extracted_from_files

Domain
detected Domain: app.com

XIOC detected Domain: app.com

extracted_from_files

URL
detected Domain: someurl.com

XIOC detected Domain: someurl.com

extracted_from_files

Domain
detected Domain: jackson.solid.community

XIOC detected Domain: jackson.solid.community

extracted_from_files

Domain
detected Domain: app.example.com

XIOC detected Domain: app.example.com

extracted_from_files

Domain
detected Domain: pod.com

XIOC detected Domain: pod.com

extracted_from_files

Domain
detected Domain: idp.com

XIOC detected Domain: idp.com

extracted_from_files

Domain
detected Domain: html5zombo.com

XIOC detected Domain: html5zombo.com

extracted_from_files

Domain
detected Domain: my.app

XIOC detected Domain: my.app

extracted_from_files

Domain
detected Domain: mysession.events

XIOC detected Domain: mysession.events

extracted_from_files

Domain
detected Domain: rp.example.org

XIOC detected Domain: rp.example.org

extracted_from_files

Domain
detected Domain: mockissuer.discover

XIOC detected Domain: mockissuer.discover

extracted_from_files

Domain
detected Domain: solidclientauthncore.events

XIOC detected Domain: solidclientauthncore.events

extracted_from_files

Domain
detected Domain: index.js.map

XIOC detected Domain: index.js.map

extracted_from_files

Domain
detected Domain: issuer.discover

XIOC detected Domain: issuer.discover

extracted_from_files

Domain
detected Domain: events.new

XIOC detected Domain: events.new

extracted_from_files

Domain
detected Domain: index.mjs.map

XIOC detected Domain: index.mjs.map

extracted_from_files

Domain
detected Domain: coolapp.com

XIOC detected Domain: coolapp.com

extracted_from_files

Domain
detected Domain: example.org

XIOC detected Domain: example.org

extracted_from_files

Domain
detected Domain: session.events

XIOC detected Domain: session.events

extracted_from_files

Domain
detected Domain: this.events

XIOC detected Domain: this.events

extracted_from_files

Domain
detected Domain: sessionoptions.storage

XIOC detected Domain: sessionoptions.storage

extracted_from_files

Domain
detected Domain: this.info

XIOC detected Domain: this.info

extracted_from_files

Domain
detected Domain: input.storage

XIOC detected Domain: input.storage

extracted_from_files

Domain
detected Domain: session.info

XIOC detected Domain: session.info

extracted_from_files

Domain
detected Domain: options.storage

XIOC detected Domain: options.storage

extracted_from_files

Domain
detected Domain: date.now

XIOC detected Domain: date.now

extracted_from_files

Domain
detected Domain: sessions.map

XIOC detected Domain: sessions.map

extracted_from_files

Domain
detected Domain: tokenset.id

XIOC detected Domain: tokenset.id

extracted_from_files

Domain
detected Domain: solidclientauthncore.events.new

XIOC detected Domain: solidclientauthncore.events.new

extracted_from_files

Domain
detected Domain: tokenset.claims

XIOC detected Domain: tokenset.claims

extracted_from_files

Domain
detected Domain: registeredclient.metadata.id

XIOC detected Domain: registeredclient.metadata.id

extracted_from_files

Domain
detected Domain: tokens.id

XIOC detected Domain: tokens.id

extracted_from_files

Domain
detected Domain: fetch.spec.whatwg.org

XIOC detected Domain: fetch.spec.whatwg.org

extracted_from_files

URL
detected URL: https://my.webid

XIOC detected URL: https://my.webid

extracted_from_files

Security Analysis Summary

Security Analysis Overview

@inrupt/solid-client-authn-node is a n8n extension published by GitHub Actions. Version 3.1.1 has been analyzed by the Risky Plugins security platform, receiving a risk score of 100/100 (CRITICAL risk) based on 334 security findings.

Risk Assessment

This extension presents critical security risk. Severe issues were detected, potentially including malware indicators, exposed secrets, or dangerous behaviors. Installation is strongly discouraged until these issues are addressed.

Findings Breakdown

  • Medium: 188 finding(s)
  • Low: 146 finding(s)

What Was Analyzed

The security assessment covers multiple analysis categories:

  • Malware Detection: YARA rule matching against 2,400+ malware signatures
  • Secret Detection: Scanning for exposed API keys, tokens, and credentials
  • Static Analysis: Code-level security analysis for common vulnerability patterns
  • Network Analysis: Detection of suspicious network communications and endpoints
  • Obfuscation Detection: Identification of code obfuscation techniques

Developer Information

@inrupt/solid-client-authn-node is published by GitHub Actions on the n8n marketplace.

Recommendation

This extension is not recommended for installation without thorough manual review. Consider alternatives with lower risk scores, or contact the developer to address the identified security concerns.

Frequently Asked Questions