Home / node-red / node-red
AI Slop Code RIsk Monitor

node-red/node-red

Low-code programming for event-driven applications

91.5 High pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for node-red/node-red, a JavaScript project with 23,731 GitHub stars. SynthScan examined 77,449 lines of code across 274 source files, recording 726 pattern matches distributed across 6 syntactic categories. The legacy adjusted pattern signal is 91.5 (High pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

91.5
Adjusted Signal
91.5
Raw Pattern Score
100%
Time Factor
2026-10-10
Last Push
23.7K
Stars
JavaScript
Language
77.4K
Lines of Code
274
Files
726
Pattern Hits
2026-10-12
Scan Date
2.48
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 2.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 40 finding(s).

Hallucinated Dependency & Supply Chain Risk 98.9/100 · CRITICAL

Are imports declared and package/API names verified? 686 finding(s).

Agent Over-Engineering Ratio 0.5/100 · LOW

Are wrappers, guards, and repeated structures necessary? 8 finding(s).

PR Review Velocity Impact 98.8/100 · CRITICAL

Which changes need focused human review? 726 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 680HIGH 0MEDIUM 2LOW 44

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 726 distinct pattern matches across 6 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators680 hits · 7040 pts
SeverityFileLineSnippetContext
CRITICALtest/unit/@node-red/util/lib/log_spec.js69 console.log.calledOnce.should.be.true();CODE
CRITICALtest/unit/@node-red/util/lib/log_spec.js90 console.log.calledOnce.should.be.true();CODE
CRITICALtest/unit/@node-red/util/lib/log_spec.js95 console.log.calledOnce.should.be.true();CODE
CRITICALtest/unit/@node-red/util/lib/util_spec.js132 cloned.object.subobject.should.not.equal(msg.object.subobject);CODE
CRITICALtest/unit/@node-red/util/lib/util_spec.js236 msg.a.b.c.should.eql('bar');CODE
CRITICALtest/unit/@node-red/util/lib/util_spec.js242 msg.a.b.c.should.eql('bar');CODE
CRITICALtest/unit/@node-red/util/lib/util_spec.js351 msg.a.should.not.have.property("b[2]");CODE
CRITICALtest/unit/@node-red/editor-api/lib/auth/index_spec.js44 req.body.should.have.a.property("client_secret","test_value");CODE
CRITICALtest/unit/@node-red/editor-api/lib/auth/index_spec.js53 req.body.should.have.a.property("client_secret","not_available");CODE
CRITICALtest/unit/@node-red/editor-api/lib/auth/index_spec.js94 resp.prompts.should.have.a.lengthOf(2);CODE
CRITICALtest/unit/@node-red/editor-api/lib/auth/index_spec.js110 resp.prompts.should.have.a.lengthOf(1);CODE
CRITICALtest/unit/@node-red/editor-api/lib/auth/index_spec.js145 passport.authenticate.called.should.be.false();CODE
CRITICALtest/unit/@node-red/editor-api/lib/auth/index_spec.js160 passport.authenticate.called.should.be.true();CODE
CRITICALtest/unit/@node-red/editor-api/lib/auth/index_spec.js161 Permissions.hasPermission.called.should.be.false();CODE
CRITICALtest/unit/@node-red/editor-api/lib/auth/index_spec.js180 passport.authenticate.called.should.be.true();CODE
CRITICALtest/unit/@node-red/editor-api/lib/auth/index_spec.js181 Permissions.hasPermission.called.should.be.true();CODE
CRITICALtest/unit/@node-red/editor-api/lib/auth/users_spec.js46 user.should.not.have.a.property("password");CODE
CRITICALtest/unit/@node-red/editor-api/lib/auth/users_spec.js85 user.should.not.have.a.property("password");CODE
CRITICALtest/unit/@node-red/editor-api/lib/auth/users_spec.js166 user.should.not.have.a.property("password");CODE
CRITICALtest/unit/@node-red/editor-api/lib/auth/users_spec.js178 user.should.not.have.a.property("password");CODE
CRITICALtest/unit/@node-red/editor-api/lib/auth/tokens_spec.js284 savedSession.should.not.have.a.property("1234");CODE
CRITICAL…t/unit/@node-red/editor-api/lib/admin/settings_spec.js88 res.body.should.not.have.property("editorTheme");CODE
CRITICAL⚡test/unit/@node-red/editor-api/lib/admin/flows_spec.js78 res.body.should.have.a.property('rev','123');CODE
CRITICAL⚡test/unit/@node-red/editor-api/lib/admin/flows_spec.js79 res.body.should.have.a.property('flows');CODE
CRITICAL⚡test/unit/@node-red/editor-api/lib/admin/flows_spec.js80 res.body.flows.should.have.lengthOf(3);CODE
CRITICALtest/unit/@node-red/editor-api/lib/admin/flows_spec.js98 res.body.should.have.a.property('code','invalid_api_version');CODE
CRITICALtest/unit/@node-red/editor-api/lib/admin/flows_spec.js185 res.body.should.have.a.property('code','invalid_api_version');CODE
CRITICALtest/unit/@node-red/editor-api/lib/admin/flows_spec.js233 res.body.should.have.a.property('started', true);CODE
CRITICALtest/unit/@node-red/editor-api/lib/admin/flows_spec.js234 res.body.should.have.a.property('state', "started");CODE
CRITICALtest/unit/@node-red/editor-api/lib/admin/flows_spec.js264 res.body.should.have.a.property('started', false);CODE
CRITICALtest/unit/@node-red/editor-api/lib/admin/flows_spec.js265 res.body.should.have.a.property('state', "stopped");CODE
CRITICALtest/unit/@node-red/editor-api/lib/admin/nodes_spec.js70 res.body.should.be.an.Array();CODE
CRITICALtest/unit/@node-red/editor-api/lib/admin/nodes_spec.js274 res.body.should.have.a.property('code','random_error');CODE
CRITICALtest/unit/@node-red/editor-api/lib/admin/nodes_spec.js323 res.body.should.have.a.property('code','random_error');CODE
CRITICALtest/unit/@node-red/editor-api/lib/admin/nodes_spec.js448 res.body.module.should.be.an.Array();CODE
CRITICALtest/unit/@node-red/editor-api/lib/admin/nodes_spec.js449 res.body.module.should.have.lengthOf(3);CODE
CRITICALtest/unit/@node-red/editor-api/lib/admin/flow_spec.js70 res.body.should.has.a.property('id','123');CODE
CRITICALtest/unit/@node-red/editor-api/lib/admin/flow_spec.js114 res.body.should.has.a.property('id','123');CODE
CRITICALtest/unit/@node-red/editor-api/lib/admin/flow_spec.js128 res.body.should.has.a.property('code','random_error');CODE
CRITICALtest/unit/@node-red/editor-api/lib/admin/flow_spec.js129 res.body.should.has.a.property('message','random error');CODE
CRITICALtest/unit/@node-red/editor-api/lib/admin/flow_spec.js169 res.body.should.has.a.property('id','123');CODE
CRITICALtest/unit/@node-red/editor-api/lib/admin/flow_spec.js186 res.body.should.has.a.property('code','random_error');CODE
CRITICALtest/unit/@node-red/editor-api/lib/admin/flow_spec.js187 res.body.should.has.a.property('message','random error');CODE
CRITICALtest/unit/@node-red/editor-api/lib/admin/flow_spec.js240 res.body.should.has.a.property('code','random_error');CODE
CRITICALtest/unit/@node-red/editor-api/lib/admin/flow_spec.js241 res.body.should.has.a.property('message','random error');CODE
CRITICAL…st/unit/@node-red/editor-api/lib/admin/context_spec.js161 res.body.should.has.a.property('code', 'unexpected_error');CODE
CRITICAL…st/unit/@node-red/editor-api/lib/admin/context_spec.js162 res.body.should.has.a.property('message', 'error');CODE
CRITICAL…st/unit/@node-red/editor-api/lib/admin/context_spec.js266 res.body.should.has.a.property('code', 'unexpected_error');CODE
CRITICAL…st/unit/@node-red/editor-api/lib/admin/context_spec.js267 res.body.should.has.a.property('message', 'error');CODE
CRITICALtest/unit/@node-red/editor-api/lib/editor/index_spec.js45 comms.init.called.should.be.false();CODE
CRITICALtest/unit/@node-red/editor-api/lib/editor/index_spec.js46 info.init.called.should.be.false();CODE
CRITICAL⚡test/unit/@node-red/editor-api/lib/editor/theme_spec.js43 context.page.should.have.a.property("title", "Node-RED");CODE
CRITICAL⚡test/unit/@node-red/editor-api/lib/editor/theme_spec.js44 context.page.should.have.a.property("favicon", "favicon.ico");CODE
CRITICAL⚡test/unit/@node-red/editor-api/lib/editor/theme_spec.js45 context.page.should.have.a.property("tabicon");CODE
CRITICAL⚡test/unit/@node-red/editor-api/lib/editor/theme_spec.js46 context.page.tabicon.should.have.a.property("icon", "red/images/node-red-icon-black.svg");CODE
CRITICAL⚡test/unit/@node-red/editor-api/lib/editor/theme_spec.js47 context.page.tabicon.should.have.a.property("colour", "#8f0000");CODE
CRITICAL⚡test/unit/@node-red/editor-api/lib/editor/theme_spec.js49 context.header.should.have.a.property("title", "Node-RED");CODE
CRITICAL⚡test/unit/@node-red/editor-api/lib/editor/theme_spec.js50 context.header.should.have.a.property("image", "red/images/node-red-icon.svg");CODE
CRITICAL⚡test/unit/@node-red/editor-api/lib/editor/theme_spec.js52 context.asset.should.have.a.property("red", "red/red.min.js");CODE
CRITICAL⚡test/unit/@node-red/editor-api/lib/editor/theme_spec.js53 context.asset.should.have.a.property("main", "red/main.min.js");CODE
620 more matches not shown…
Over-Commented Block30 hits · 28 pts
SeverityFileLineSnippetContext
LOWtest/unit/node-red/lib/red_spec.js41 // runtime.init.restore();COMMENT
LOWtest/unit/@node-red/editor-api/lib/editor/index_spec.js121 done();COMMENT
LOW…t/unit/@node-red/editor-api/lib/editor/locales_spec.js41 // callback();COMMENT
LOW…t/unit/@node-red/editor-api/lib/editor/locales_spec.js121 // var app;COMMENT
LOW…t/unit/@node-red/editor-api/lib/editor/locales_spec.js141 // }COMMENT
LOW…t/unit/@node-red/editor-api/lib/editor/locales_spec.js161 // done();COMMENT
LOWtest/unit/@node-red/runtime/lib/nodes/Node_spec.js601 // it('emits messages without cloning req or res', function(done) {COMMENT
LOWtest/unit/@node-red/runtime/lib/nodes/Node_spec.js621 // msg.req.should.be.exactly(message.req);COMMENT
LOWtest/unit/@node-red/runtime/lib/nodes/Node_spec.js641 //COMMENT
LOWtest/unit/@node-red/runtime/lib/nodes/Node_spec.js661 // send: (node,dst,msg) => { setImmediate(function() { flow.getNode(dst).receive(msg) })}COMMENT
LOWtest/unit/@node-red/runtime/lib/flows/index_spec.js441 c.should.equal(2);COMMENT
LOWtest/unit/@node-red/runtime/lib/flows/index_spec.js461 // flows.handleError(originalConfig[0],"message",{});COMMENT
LOWtest/unit/@node-red/runtime/lib/flows/index_spec.js481 // storage.getFlows = function() {COMMENT
LOWtest/unit/@node-red/runtime/lib/flows/index_spec.js501 // });COMMENT
LOWtest/unit/@node-red/runtime/lib/flows/index_spec.js521 // flows.startFlows();COMMENT
LOWtest/unit/@node-red/runtime/lib/flows/index_spec.js541 // try {COMMENT
LOWtest/unit/@node-red/registry/lib/loader_spec.js461 done();COMMENT
LOWtest/unit/@node-red/registry/lib/loader_spec.js481 // };COMMENT
LOWtest/unit/@node-red/registry/lib/loader_spec.js501 // module.nodes.DuffNode.should.have.property("module","node-red");COMMENT
LOWtest/nodes/core/parsers/70-JSON_spec.js221 // var logEvents = helper.log().args.filter(function(evt) {COMMENT
LOWtest/nodes/core/common/60-link_spec.js181 });COMMENT
LOWtest/nodes/core/common/60-link_spec.js201 // var n4 = helper.getNode("n4");COMMENT
LOWtest/editor/wdio.conf.js21 // ==================COMMENT
LOWtest/editor/wdio.conf.js41 // time. Depending on the number of capabilities, WebdriverIO launches several testCOMMENT
LOWtest/editor/wdio.conf.js61 // 5 instances get started at a time.COMMENT
LOWtest/editor/wdio.conf.js81 coloredLogs: true,COMMENT
LOWtest/editor/wdio.conf.js101 //COMMENT
LOWtest/editor/wdio.conf.js121 // screenWidth: [320,480,640,1024]COMMENT
LOWtest/editor/wdio.conf.js141 // Test reporter for stdout.COMMENT
LOWscripts/build-custom-theme.js1#!/usr/bin/env nodeCOMMENT
Hyper-Verbose Identifiers8 hits · 8 pts
SeverityFileLineSnippetContext
LOW…st/unit/@node-red/registry/lib/externalModules_spec.js28async function setupExternalModulesPackage(dependencies) {CODE
LOWtest/nodes/core/network/21-httprequest_spec.js190 function getSslTestURLWithoutProtocol(url) {CODE
LOWtest/nodes/core/network/21-mqtt_spec.js730function buildBasicMQTTSendRecvFlow(brokerOptions, inOptions, outOptions) {CODE
LOWtest/nodes/core/function/10-switch_spec.js125 function customFlowMessageSwitchTest(flow, shouldReceive, message, done) {CODE
LOWtest/nodes/core/function/10-switch_spec.js150 function customFlowSequenceSwitchTest(flow, seq_in, seq_out, repair, modifier, done) {CODE
LOWtest/nodes/core/function/10-switch_spec.js952 function customFlowSequenceMultiSwitchTest(flow, seq_in, outs, repair, done) {CODE
LOWtest/nodes/core/function/89-trigger_spec.js1178 function mapiDoneTriggerTestHelper(done, nodeSetting, msgAndTimings) {CODE
LOWtest/nodes/core/function/89-delay_spec.js182 function genericRateLimitSECONDSTest(aLimit, nbUnit, runtimeInMillis, rateValue, done) {CODE
Fake / Example Data6 hits · 6 pts
SeverityFileLineSnippetContext
LOW…lib/storage/localfilesystem/projects/ssh/index_spec.js248 comment: 'test@test.com',CODE
LOW…lib/storage/localfilesystem/projects/ssh/index_spec.js271 comment: 'test@test.com',CODE
LOW…lib/storage/localfilesystem/projects/ssh/index_spec.js295 comment: 'test@test.com',CODE
LOW…lib/storage/localfilesystem/projects/ssh/index_spec.js319 comment: 'test@test.com',CODE
LOW…lib/storage/localfilesystem/projects/ssh/index_spec.js344 comment: 'test@test.com',CODE
LOW…lib/storage/localfilesystem/projects/ssh/index_spec.js371 comment: 'test@test.com',CODE
Modern AI Meta-Vocabulary1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMREADME.md9### Low-code programming for event-driven applicationsCOMMENT
AI Slop Vocabulary1 hit · 2 pts
SeverityFileLineSnippetContext
MEDIUMpackage-lock.json11454 "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz",CODE