Sentinel intercepts credential theft, monkey-patching, hook injection, and 30+ attack vectors at runtime — without modifying the Node-RED core.
cd ~/.node-red
npm install @allanoricil/nrg-sentinel
NODE_OPTIONS="--require @allanoricil/nrg-sentinel/preload" node-red
docker pull allanoricil/nrg-sentinel
docker run -p 1880:1880 -v ~/.node-red:/data allanoricil/nrg-sentinel
Every third-party package starts with zero privileges. You explicitly grant only what each package needs.
node:credentials:read before it can touch any secret.require() for fs, http, child_process, vm, and worker_threads. Blocked calls are logged with the exact grant needed to allow them.onSend/onReceive hooks to silently intercept or modify messages in the pipeline.settings.js edit or restart needed.In production, a single accidental or malicious deploy can break a running system. Sentinel intercepts deployments before they apply and holds them in a persistent queue until an admin approves.
Sentinel shares the Node.js process with the packages it protects against — no sandbox, no separate runtime. Defense comes from layered JavaScript hardening applied before any third-party code loads.
Object.preventExtensions on every built-in prototype before the first require(). Blocks prototype pollution from injecting properties that would silently pass capability checks.Module._load and immediately locks it configurable: false. Every require('fs'), require('child_process'), and require('vm') goes through a capability check before the module is handed to the caller.getNode() is wrapped in a Proxy with get, set, and defineProperty traps. Credentials, wires, and context are guarded at the language level — there is no way to bypass a Proxy from JavaScript without the original reference.String.prototype.includes, Array.prototype.indexOf, WeakMap.prototype.get, and 20+ more — is pinned as a bound function before any package loads, so overwriting a prototype method cannot blind a guard.new Function() and eval are treated as untrusted, closing the deep-stack-bypass attack class.preload.js and plugin.js against their startup baseline and checks for permission bit changes. On-disk tampering is detected even if the attacker gained filesystem write access through a separate vulnerability.Three steps. No Node-RED fork, no custom runtime, no infrastructure changes.
NODE_OPTIONS so the preload guard is injected before any node package is imported, then start Node-RED as usual.settings.js.settings.js.One license key per Node-RED instance. No seat counting, no phone-home.
--require preload. It does not patch Node-RED's source, fork the runtime, or require any custom build. Removing Sentinel is as simple as uninstalling the package.LICENSE.md in the package for the full terms.