[ ] Check package author history
[ ] Review download count (low = higher risk)
[ ] Examine GitHub repo for source code
[ ] Check last update date (stale = potential risk)
[ ] Read package.json for dependencies
[ ] Search for security advisories
[ ] Prefer verified nodes when available
[ ] Test in isolated environment first

# Disable community nodes entirely (most secure)
N8N_COMMUNITY_PACKAGES_ENABLED=false

# If you must use community nodes, audit installed packages
docker exec n8n npm list --depth=0

Settings → Community Nodes → Install a community node
Enter: package-name (e.g., n8n-nodes-globals)
Click: Install

# Install to n8n's node_modules
cd ~/.n8n
npm install n8n-nodes-package-name

# Restart n8n
pm2 restart n8n
# or
docker-compose restart n8n

FROM n8nio/n8n:latest

# Install community nodes
RUN cd /usr/local/lib/node_modules/n8n && \
    npm install n8n-nodes-globals \
    n8n-nodes-tesseractjs \
    n8n-nodes-deepseek

# docker-compose.yml
services:
  n8n:
    image: n8nio/n8n
    environment:
      - N8N_COMMUNITY_PACKAGES=n8n-nodes-globals,n8n-nodes-tesseractjs

# Comma-separated list of packages to install on startup
N8N_COMMUNITY_PACKAGES="n8n-nodes-globals,n8n-nodes-deepseek"

{
  "nodes": [
    {
      "type": "n8n-nodes-base.mcpTrigger",
      "typeVersion": 1,
      "name": "MCP Server Trigger",
      "parameters": {
        "toolName": "search_database",
        "toolDescription": "Search the product database by query"
      }
    }
  ]
}

{
  "type": "@n8n/n8n-nodes-langchain.toolMcp",
  "typeVersion": 1,
  "parameters": {
    "sseEndpoint": "https://mcp-server.example.com/sse",
    "authentication": "bearerAuth"
  },
  "credentials": {
    "httpBearerAuth": {
      "id": "credential-id"
    }
  }
}

# Install community MCP node
npm install n8n-nodes-mcp

# Required environment variable for AI Agent tool usage
N8N_COMMUNITY_PACKAGES_ALLOW_TOOL_USAGE=true

// Sub-workflow that becomes an AI tool
// Receives: $json.query from the AI agent

const searchResults = await fetch(`https://api.example.com/search?q=${$json.query}`);
const data = await searchResults.json();

return [{
  json: {
    response: data.results.map(r => r.title).join('\n')
  }
}];

{
  "type": "@n8n/n8n-nodes-langchain.vectorStorePinecone",
  "typeVersion": 1,
  "parameters": {
    "pineconeIndex": "my-index",
    "pineconeNamespace": "documents",
    "topK": 5
  },
  "credentials": {
    "pineconeApi": {
      "id": "credential-id",
      "name": "Pinecone API"
    }
  }
}

# Scaffold a new node package
npm create @n8n/node

# Or clone the starter template
git clone https://github.com/n8n-io/n8n-nodes-starter.git
cd n8n-nodes-starter
npm install

n8n-nodes-my-package/
├── package.json           # Node registration
├── nodes/
│   └── MyNode/
│       ├── MyNode.node.ts  # Node implementation
│       └── myNode.svg      # Node icon
├── credentials/
│   └── MyCredential.credentials.ts
└── dist/                   # Compiled output

{
  "name": "n8n-nodes-my-package",
  "version": "1.0.0",
  "description": "My custom n8n node",
  "license": "MIT",
  "n8n": {
    "n8nNodesApiVersion": 1,
    "nodes": [
      "dist/nodes/MyNode/MyNode.node.js"
    ],
    "credentials": [
      "dist/credentials/MyCredential.credentials.js"
    ]
  },
  "devDependencies": {
    "@n8n/n8n-nodes-langchain": "^1.0.0",
    "n8n-workflow": "^1.0.0",
    "typescript": "^5.0.0"
  }
}

import {
  INodeType,
  INodeTypeDescription,
} from 'n8n-workflow';

export class MyApiNode implements INodeType {
  description: INodeTypeDescription = {
    displayName: 'My API',
    name: 'myApi',
    icon: 'file:myApi.svg',
    group: ['transform'],
    version: 1,
    subtitle: '={{$parameter["operation"]}}',
    description: 'Interact with My API',
    defaults: {
      name: 'My API',
    },
    inputs: ['main'],
    outputs: ['main'],
    credentials: [
      {
        name: 'myApiCredentials',
        required: true,
      },
    ],
    requestDefaults: {
      baseURL: 'https://api.example.com/v1',
      headers: {
        Accept: 'application/json',
        'Content-Type': 'application/json',
      },
    },
    properties: [
      {
        displayName: 'Resource',
        name: 'resource',
        type: 'options',
        noDataExpression: true,
        options: [
          { name: 'User', value: 'user' },
          { name: 'Item', value: 'item' },
        ],
        default: 'user',
      },
      {
        displayName: 'Operation',
        name: 'operation',
        type: 'options',
        noDataExpression: true,
        displayOptions: {
          show: { resource: ['user'] },
        },
        options: [
          { name: 'Get', value: 'get', action: 'Get a user' },
          { name: 'List', value: 'list', action: 'List users' },
        ],
        default: 'get',
      },
    ],
  };
}

import {
  IExecuteFunctions,
  INodeExecutionData,
  INodeType,
  INodeTypeDescription,
} from 'n8n-workflow';

export class MyNode implements INodeType {
  description: INodeTypeDescription = {
    displayName: 'My Node',
    name: 'myNode',
    group: ['transform'],
    version: 1,
    description: 'Process data with custom logic',
    defaults: { name: 'My Node' },
    inputs: ['main'],
    outputs: ['main'],
    properties: [
      {
        displayName: 'Field',
        name: 'field',
        type: 'string',
        default: '',
        required: true,
      },
    ],
  };

  async execute(this: IExecuteFunctions): Promise<INodeExecutionData[][]> {
    const items = this.getInputData();
    const field = this.getNodeParameter('field', 0) as string;

    const results = items.map(item => ({
      json: {
        ...item.json,
        processed: true,
        field,
      },
    }));

    return [results];
  }
}

npm run dev       # Start n8n with hot reload
npm run build     # Compile TypeScript
npm run lint      # Validate code quality
npm run lint:fix  # Auto-fix issues
npm run release   # Manage version releases

# 1. Build production code
npm run build

# 2. Test locally
npm run dev

# 3. Publish to npm
npm publish

# 4. (Optional) Submit for verification via n8n Creator Portal

# Search for community nodes
npm search n8n-nodes

# Check package info
npm info n8n-nodes-package-name

# View package security
npm audit n8n-nodes-package-name

topic:n8n-node language:TypeScript
"n8n-nodes-" in:name

# Clear n8n cache
rm -rf ~/.n8n/node_modules/.cache

# Reinstall community nodes
npm install n8n-nodes-package-name --force

# Disable community nodes if not needed
N8N_COMMUNITY_PACKAGES_ENABLED=false

# Restrict outbound network access
# (via firewall rules or Docker network policies)

# Use read-only filesystem for n8n container
# (where possible)

# Regular security audits
npm audit