Hello,
I would like to request a manual review for a flagged version of my ComfyUI custom node.
Node ID: hunyuanimage3-low-memory
Publisher: foxidermist
Version: 0.4.0
Repository: https://github.com/foxidermist/hunyuanimage3-low-memory
Release: https://github.com/foxidermist/hunyuanimage3-low-memory/releases/tag/v0.4.0
The version was successfully published to the Registry, but it has remained:
NodeVersionStatusFlagged
for more than 24 hours, so ComfyUI Manager still shows 0.3.0 as the latest active version.
The Registry scanner reports one YARA finding:
- scanner: yara_scan
- issue_type: python_environment_manipulation
- severity: info
- admin_tags:
- any-folder-access
- system-modification
- matched pattern: os.environ.get(
- MITRE mapping: T1574.007 Environment Variable Hijacking
The flagged code is in hunyuan_instruct_nodes.py and only READS environment variables:
override = os.environ.get("HUNYUAN_DISK_OFFLOAD_DIR", "").strip()
cache_root = os.environ.get("LOCALAPPDATA")
cache_root = os.environ.get("XDG_CACHE_HOME")
These values are used only to determine the SSD-offload/cache directory.
The node does not modify these environment variables, does not modify PATH, and does not perform environment-variable hijacking.
HUNYUAN_DISK_OFFLOAD_DIR is an optional user configuration override.
LOCALAPPDATA is used to select the normal Windows application cache directory.
XDG_CACHE_HOME is used for the corresponding cache location on Linux.
The scanner report itself classifies this finding with severity "info".
The 0.4.0 package is otherwise published successfully, and the Registry /install endpoint already resolves version 0.4.0 with its CDN package, while the latest active version remains 0.3.0.
Could someone please manually review version 0.4.0 and, if appropriate, mark it as active?
Thank you.
Hello,
I would like to request a manual review for a flagged version of my ComfyUI custom node.
Node ID: hunyuanimage3-low-memory
Publisher: foxidermist
Version: 0.4.0
Repository: https://github.com/foxidermist/hunyuanimage3-low-memory
Release: https://github.com/foxidermist/hunyuanimage3-low-memory/releases/tag/v0.4.0
The version was successfully published to the Registry, but it has remained:
NodeVersionStatusFlagged
for more than 24 hours, so ComfyUI Manager still shows 0.3.0 as the latest active version.
The Registry scanner reports one YARA finding:
The flagged code is in hunyuan_instruct_nodes.py and only READS environment variables:
These values are used only to determine the SSD-offload/cache directory.
The node does not modify these environment variables, does not modify PATH, and does not perform environment-variable hijacking.
HUNYUAN_DISK_OFFLOAD_DIR is an optional user configuration override.
LOCALAPPDATA is used to select the normal Windows application cache directory.
XDG_CACHE_HOME is used for the corresponding cache location on Linux.
The scanner report itself classifies this finding with severity "info".
The 0.4.0 package is otherwise published successfully, and the Registry /install endpoint already resolves version 0.4.0 with its CDN package, while the latest active version remains 0.3.0.
Could someone please manually review version 0.4.0 and, if appropriate, mark it as active?
Thank you.