# Is It possible to download malicious software with node-red?

**URL:** <https://discourse.nodered.org/t/is-it-possible-to-download-malicious-software-with-node-red/44894>\
**Category:** General\
**Created:** [28 April 2021 21:02 UTC](https://discourse.nodered.org/t/is-it-possible-to-download-malicious-software-with-node-red/44894 "2021-04-28T21:02:52Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Toster](https://avatars.discourse-cdn.com/v4/letter/t/c57346/32.png) [@Toster](https://discourse.nodered.org/u/Toster)\
**Post date:** [28 April 2021 21:02 UTC](https://discourse.nodered.org/t/is-it-possible-to-download-malicious-software-with-node-red/44894/1 "2021-04-28T21:02:52Z")

</div>

I have never thought about it and just downloaded random nodes from the "manage pallete" tab. Is It possible? Are those packages checked somehow? Or should i be more careful.  
Just wondering. Thank you in advance for your answers.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [28 April 2021 21:05 UTC](https://discourse.nodered.org/t/is-it-possible-to-download-malicious-software-with-node-red/44894/2 "2021-04-28T21:05:40Z")

</div>

The Flow Library doesn't do any validation of the functionality provided by the nodes.

It is always worth taking a closer look at a module before downloading it. For example, how many downloads has it had? Is it a popular module?

If anyone does see anything of concern they can click the 'report module' link on its Flow Library page and then we can take a look.

---

<div class="post-metadata">

**Author:** ![Peter](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/peter/32/25135_2.png) [@Peter](https://discourse.nodered.org/u/Peter)\
**Post date:** [28 April 2021 21:17 UTC](https://discourse.nodered.org/t/is-it-possible-to-download-malicious-software-with-node-red/44894/3 "2021-04-28T21:17:48Z")

</div>

Great Question

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [28 April 2021 21:20 UTC](https://discourse.nodered.org/t/is-it-possible-to-download-malicious-software-with-node-red/44894/4 "2021-04-28T21:20:05Z")

</div>

Any software platform that can execute code from other people is subject to potentially malicious software. Though it is far more likely that something will be accidental rather than deliberate. But it isn't unheard of for a popular library to have something slipped into it.

Not much you can do except be careful who's software you install and restrict updates if you are doing something sensitive.

It is far more likely that an Internet connected device will be compromised than something malicious slipped into a custom node.

---

<div class="post-metadata">

**Author:** ![wb666greene](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/wb666greene/32/6534_2.png) [@wb666greene](https://discourse.nodered.org/u/wb666greene)\
**Post date:** [28 April 2021 22:04 UTC](https://discourse.nodered.org/t/is-it-possible-to-download-malicious-software-with-node-red/44894/5 "2021-04-28T22:04:32Z")

</div>

Not node-red specifically, but the underlying stuff its built upon has had some "inside jobs" putting malicious code in the repos. Some of these are pretty old news.

[https://www.zdnet.com/article/malicious-npm-packages-caught-installing-remote-access-trojans/](https://www.zdnet.com/article/malicious-npm-packages-caught-installing-remote-access-trojans/)

[https://securityreport.com/nodejs-malware-caught-exfiltrating-ips-username-and-device-information-on-github/](https://securityreport.com/nodejs-malware-caught-exfiltrating-ips-username-and-device-information-on-github/)

[https://www.trendmicro.com/vinfo/es/security/news/cybercrime-and-digital-threats/hacker-infects-node-js-package-to-steal-from-bitcoin-wallets](https://www.trendmicro.com/vinfo/es/security/news/cybercrime-and-digital-threats/hacker-infects-node-js-package-to-steal-from-bitcoin-wallets)

Pretty easy to find more if you search.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [27 June 2021 22:04 UTC](https://discourse.nodered.org/t/is-it-possible-to-download-malicious-software-with-node-red/44894/6 "2021-06-27T22:04:52Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.