atacan
July 18, 2026, 12:14pm
1
n8n-nodes-speechall@0.1.5Hi n8n team,
I’m reporting what appears to be a scanner-version mismatch in the Creator Portal affecting the n8n-nodes-speechall@0.1.5 community package.
Package: n8n-nodes-speechall@0.1.5https://www.npmjs.com/package/n8n-nodes-speechall GitHub - Speechall/speechall-n8n-node · GitHub 61562b67af982c735a943a5fa1b38b0ba838a032
@n8n /scan-community-package@0.27.0 falsely rejects:@n8n /scan-community-package@0.28.1 passes all checks.This exact .d.ts false positive was fixed in n8n PR #34214 PR #34391 .
Can you please confirm the Creator Portal scanner version, update its vetting worker,
Hi @atacan
To get this resolved quickly, please escalate this report through the following official channels:
n8n Discord (#community-nodes channel): This is the fastest way to get the attention of the developers who maintain the community node ecosystem. Post your findings there, as the maintainers can manually trigger a worker update or a re-scan.Support Email: Send this exact report to support@n8n.io. Because you have cited the specific PRs, the support team can route this directly to the core team as a “confirmed bug” rather than a general support request.
When posting/emailing, keep the following summary for the engineers:
Issue: Creator Portal using outdated scanner (@n8n/scan-community-package@0.27.0) causing false positives on .d.ts files.Affected Package: n8n-nodes-speechall@0.1.5Failed File: dist/credentials/SpeechallApi.credentials.d.tsResolution: Update Portal scanner to v0.28.1 (Fix implemented in PR #34214 / #34391 ).Request: Update vetting worker → Clear cache → Rerun submission.
Hi @atacan Welcome!#34214 , fix(core): Lint community packages against their provenance-attested source, merged into master on July 15, 2026. @n8n/scan-community-package 0.28.0 published to npm the next day, 0.28.1 the day after. That timeline lines up exactly with your report: 0.27.0, published July 14, predates the fix, 0.28.1 doesn’t.
master ← fix-package-scan-source
opened 08:52AM - 15 Jul 26 UTC
## Summary
`@n8n/scan-community-package` linted only the **compiled** output sh… ipped in published tarballs. The node/credential lint rules are written for `.ts` sources: against `dist/` output they mostly silently no-op (the plugin's own file resolution maps `dist/nodes/Foo.node.js` → `nodes/Foo.node.ts`, which doesn't exist in a tarball) or false-positive (the filename-convention rules can never be satisfied by `.d.ts` files).
Since npm provenance is already mandatory for the scan to proceed, the attestation tells us exactly which repo + commit the published artifact was built from. This PR makes the scanner:
1. Parse the provenance attestation (`registry.npmjs.org/-/npm/v1/attestations/…`) to extract the attested GitHub repo and commit.
2. Download that exact source checkout and locate the package root by `package.json` name (monorepo-aware).
3. Lint the source scoped to `package.json` + `nodes/**` + `credentials/**` — the same surface `n8n-node lint` covers at dev time, deliberately excluding repo dev files (gulpfile, test configs, committed `dist/`) that never end up in the published package.
4. **Keep scanning the shipped artifact**: provenance pins the source commit, not the build output — a build step can emit anything into `dist/`. The tarball leg is scoped to compiled `**/*.js` + the published `package.json` (so `no-dangerous-functions`, `no-restricted-imports`, `no-forbidden-lifecycle-scripts`, `no-console` etc. still run against what users actually install); `.ts`/`.d.ts` declarations are covered better by the source scan and only false-positive on filename rules there.
5. **Hard-fail when the source can't be fetched** (unsupported host, unreachable repo, no matching package root) with an actionable message — a tarball-only fallback would silently reintroduce the blind spot this PR removes. Both source-fetch requests are bounded by a 30s timeout so a stalled connection fails fast instead of hanging the gate.
Since `.ts`/`.d.ts` files are never linted from tarballs anymore, this supersedes the need for #34203 on this path.
## How to test
```bash
cd packages/@n8n/scan-community-package && pnpm vitest run scanner/scanner.test.mjs
```
End-to-end against the package from the ticket:
```bash
node packages/@n8n/scan-community-package/scanner/cli.mjs @luzconsulting/n8n-nodes-salessuite
```
- **Before:** fails with the bogus `Rename file to SalesSuiteApi.credentials.ts` false positive; all source-level rules blind.
- **After:** `✅ Fetched source from github.com/luzconsulting/n8n-nodes-salessuite@42cdce5` — the false positive is gone, and the scan surfaces 6 real violations in the source (`require-node-api-error`, dynamic-options display-name rules) that the compiled-output scan missed entirely.
Note: `test/provenance.test.mjs` fails under vitest on `master` already (it uses `node:test`, which vitest 4 rejects as "no test suite") — pre-existing, untouched here.
## Related Linear tickets, Github issues, and Community forum posts
https://linear.app/n8n/issue/CE-1713
## Review / Merge checklist
- [x] I have seen this code, I have run this code, and I take responsibility for this code.
- [x] PR title and summary are descriptive. ([conventions](../blob/master/.github/pull_request_title_conventions.md))
- [ ] [Docs updated](https://github.com/n8n-docs) or follow-up ticket created.
- [x] Tests included.
- [x] PR Labeled with `Backport to Beta`, `Backport to Stable`, or `Backport to v1` (if the PR is an urgent fix that needs to be backported)
🤖 PR Summary generated by AI
🤖 Generated with [Claude Code](https://claude.com/claude-code)