n8n-nodes-globals-fork-test

Security-hardened fork of n8n-nodes-globals by Vasily Maslyukov (umanamente).

Forked from upstream commit d3e7a47 (v1.1.0). The n8n node behaviour is unchanged — this fork only hardens the build, dependency, and release pipeline.

This is an n8n community node. It lets you create global constants that can be used in any workflow.

Installation

In your n8n instance, install the package using the community-node installation flow:

n8n-nodes-globals-fork-test

See the official n8n community-nodes installation guide.

Usage

This node uses an N8N Credential to store the global variables.

1. Add the Global Constants node to your workflow.
2. In the node configuration, either select an existing credential or create a new one.
3. Select the format for your global constants:
   • Key-value pairs — one name=value per line
   • JSON — provide constants as a JSON object
4. Add your constants according to the chosen format.
5. Reference the global constants downstream in your workflow.

Why this fork exists

This fork was created to:

• Lock the dependency tree to specific, audited versions (no floating ranges).
• Block lifecycle scripts during installation as a defence against malicious devDependency hooks.
• Add reproducible CI: build, test, npm audit signatures, lockfile-lint, SBOM, SAST.
• Provide an SBOM (CycloneDX) describing every dependency.
• Allow controlled updates via Dependabot rather than untrusted upstream releases.

See docs/security.md for the full hardening details.

Relationship to upstream

The maintainers of this fork are not affiliated with the upstream author. All credit for the n8n node implementation goes to Vasily Maslyukov.

This fork tracks upstream selectively: bugfix and security patches are merged after manual review; speculative or feature changes that expand the dependency surface may be deferred or skipped.

License

MIT — see LICENSE.md and NOTICE.