{"page":1,"pageSize":10,"total":165,"totalPages":17,"versions":[{"changelog":"","comfy_node_extract_status":"pending","createdAt":"2026-09-10T21:21:21.469856Z","dependencies":["huggingface_hub\u003e=0.20.0"],"deprecated":false,"downloadUrl":"https://cdn.comfy.org/jnx/ComfyUI_HuggingFace_Downloader/1.34.21/node.zip","id":"f7aaa0cc-53c2-4a9e-8bbe-00134df8fe13","node_id":"ComfyUI_HuggingFace_Downloader","status":"NodeVersionStatusFlagged","status_reason":"[\n    {\n        \"admin_tags\": [\n            \"credential-access\",\n            \"system-modification\"\n        ],\n        \"code_snippet\": \"25 |                         pass\\n26 |                     finally:\\n27 |                         if orig_env_token is not None:\\n28 |                             os.environ[\\\"HF_TOKEN\\\"] = orig_env_token\\n29 |             raise e\\n30 | \\n31 |     huggingface_hub.file_download.hf_hub_download = _patched_hf_hub_download\",\n        \"description\": \"Detects environment variable manipulation and reading\",\n        \"file_path\": \"__init__.py\",\n        \"issue_type\": \"python_environment_manipulation\",\n        \"line_number\": 28,\n        \"line_snippet\": \"os.environ[\\\"HF_TOKEN\\\"] = orig_env_token\",\n        \"metadata\": {\n            \"confidence\": 90,\n            \"matched_patterns\": [\n                \"$env_read1\",\n                \"$env_mod1\",\n                \"$env_mod4\"\n            ],\n            \"yara_matches\": [\n                {\n                    \"filepath\": \"__init__.py\",\n                    \"strings\": [\n                        {\n                            \"identifier\": \"$env_read1\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"                            os.environ[\\\"HF_TOKEN\\\"] = orig_env_token\\n\",\n                                    \"line_number\": 28,\n                                    \"matched_data\": \"os.environ[\",\n                                    \"matched_length\": 11,\n                                    \"offset\": 28\n                                }\n                            ]\n                        },\n                        {\n                            \"identifier\": \"$env_mod1\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"                            os.environ[\\\"HF_TOKEN\\\"] = orig_env_token\\n\",\n                                    \"line_number\": 28,\n                                    \"matched_data\": \"os.environ[\\\"HF_TOKEN\\\"] =\",\n                                    \"matched_length\": 24,\n                                    \"offset\": 28\n                                }\n                            ]\n                        },\n                        {\n                            \"identifier\": \"$env_mod4\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"                    orig_env_token = os.environ.pop(\\\"HF_TOKEN\\\", None)\\n\",\n                                    \"line_number\": 21,\n                                    \"matched_data\": \"os.environ.pop(\",\n                                    \"matched_length\": 15,\n                                    \"offset\": 37\n                                }\n                            ]\n                        }\n                    ]\n                }\n            ],\n            \"yara_meta\": {\n                \"attack_id1\": \"T1574.007 Environment Variable Hijacking\",\n                \"category\": \"Defense Evasion\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects environment variable manipulation and reading\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1574/007/\",\n                \"severity\": \"3\",\n                \"version\": \"1.0\"\n            }\n        },\n        \"recommendation\": \"\",\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    },\n    {\n        \"admin_tags\": [\n            \"system-modification\"\n        ],\n        \"code_snippet\": \"1024 |     Uses snapshot_download for faster parallel downloads.\\n1025 |     \\\"\\\"\\\"\\n1026 |     # Must be set BEFORE importing huggingface_hub so hf_xet reads it at import time.\\n1027 |     os.environ[\\\"HF_HUB_ENABLE_HF_XET\\\"] = \\\"0\\\"\\n1028 |     os.environ[\\\"HF_HUB_DISABLE_XET\\\"] = \\\"1\\\"\\n1029 | \\n1030 |     from huggingface_hub import snapshot_download, hf_hub_download\",\n        \"description\": \"Detects environment variable manipulation and reading\",\n        \"file_path\": \"backup.py\",\n        \"issue_type\": \"python_environment_manipulation\",\n        \"line_number\": 1027,\n        \"line_snippet\": \"os.environ[\\\"HF_HUB_ENABLE_HF_XET\\\"] = \\\"0\\\"\",\n        \"metadata\": {\n            \"confidence\": 90,\n            \"matched_patterns\": [\n                \"$env_read1\",\n                \"$env_read3\",\n                \"$env_mod1\",\n                \"$proc_env1\"\n            ],\n            \"yara_matches\": [\n                {\n                    \"filepath\": \"backup.py\",\n                    \"strings\": [\n                        {\n                            \"identifier\": \"$env_read1\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"    os.environ[\\\"HF_HUB_ENABLE_HF_XET\\\"] = \\\"0\\\"\\n\",\n                                    \"line_number\": 1027,\n                                    \"matched_data\": \"os.environ[\",\n                                    \"matched_length\": 11,\n                                    \"offset\": 4\n                                },\n                                {\n                                    \"line\": \"    os.environ[\\\"HF_HUB_DISABLE_XET\\\"] = \\\"1\\\"\\n\",\n                                    \"line_number\": 1028,\n                                    \"matched_data\": \"os.environ[\",\n                                    \"matched_length\": 11,\n                                    \"offset\": 4\n                                }\n                            ]\n                        },\n                        {\n                            \"identifier\": \"$env_read3\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"        token = os.getenv(\\\"HF_TOKEN\\\", \\\"\\\").strip()\\n\",\n                                    \"line_number\": 495,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 16\n                                }\n                            ]\n                        },\n                        {\n                            \"identifier\": \"$env_mod1\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"    os.environ[\\\"HF_HUB_ENABLE_HF_XET\\\"] = \\\"0\\\"\\n\",\n                                    \"line_number\": 1027,\n                                    \"matched_data\": \"os.environ[\\\"HF_HUB_ENABLE_HF_XET\\\"] =\",\n                                    \"matched_length\": 36,\n                                    \"offset\": 4\n                                },\n                                {\n                                    \"line\": \"    os.environ[\\\"HF_HUB_DISABLE_XET\\\"] = \\\"1\\\"\\n\",\n                                    \"line_number\": 1028,\n                                    \"matched_data\": \"os.environ[\\\"HF_HUB_DISABLE_XET\\\"] =\",\n                                    \"matched_length\": 34,\n                                    \"offset\": 4\n                                }\n                            ]\n                        },\n                        {\n                            \"identifier\": \"$proc_env1\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"            process = subprocess.run(\\n\",\n                                    \"line_number\": 654,\n                                    \"matched_data\": \"subprocess.run(\\n                [sys.executable, manager_cli_script, \\\"save-snapshot\\\"],\\n                capture_output=True,\\n                text=True,\\n                cwd=comfy_dir,\\n                env=\",\n                                    \"matched_length\": 202,\n                                    \"offset\": 22\n                                }\n                            ]\n                        }\n                    ]\n                }\n            ],\n            \"yara_meta\": {\n                \"attack_id1\": \"T1574.007 Environment Variable Hijacking\",\n                \"category\": \"Defense Evasion\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects environment variable manipulation and reading\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1574/007/\",\n                \"severity\": \"3\",\n                \"version\": \"1.0\"\n            }\n        },\n        \"recommendation\": \"\",\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    },\n    {\n        \"admin_tags\": [\n            \"any-network-requests\",\n            \"system-modification\"\n        ],\n        \"code_snippet\": \"470 |                 \\\"import json, sys, os, urllib.request, shutil\\\\n\\\"\\n471 |                 \\\"use_xet = sys.argv[3] == '1'\\\\n\\\"\\n472 |                 \\\"if use_xet:\\\\n\\\"\\n473 |                 \\\"    os.environ['HF_HUB_DISABLE_XET'] = '0'\\\\n\\\"\\n474 |                 \\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '1'\\\\n\\\"\\n475 |                 \\\"else:\\\\n\\\"\\n476 |                 \\\"    os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\n\\\"\",\n        \"description\": \"Detects environment variable manipulation and reading\",\n        \"file_path\": \"downloader.py\",\n        \"issue_type\": \"python_environment_manipulation\",\n        \"line_number\": 473,\n        \"line_snippet\": \"\\\"    os.environ['HF_HUB_DISABLE_XET'] = '0'\\\\n\\\"\",\n        \"metadata\": {\n            \"confidence\": 90,\n            \"matched_patterns\": [\n                \"$env_read1\",\n                \"$env_read3\",\n                \"$env_mod1\",\n                \"$env_mod4\"\n            ],\n            \"yara_matches\": [\n                {\n                    \"filepath\": \"downloader.py\",\n                    \"strings\": [\n                        {\n                            \"identifier\": \"$env_read1\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"                \\\"    os.environ['HF_HUB_DISABLE_XET'] = '0'\\\\n\\\"\\n\",\n                                    \"line_number\": 473,\n                                    \"matched_data\": \"os.environ[\",\n                                    \"matched_length\": 11,\n                                    \"offset\": 21\n                                },\n                                {\n                                    \"line\": \"                \\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '1'\\\\n\\\"\\n\",\n                                    \"line_number\": 474,\n                                    \"matched_data\": \"os.environ[\",\n                                    \"matched_length\": 11,\n                                    \"offset\": 21\n                                },\n                                {\n                                    \"line\": \"                \\\"    os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\n\\\"\\n\",\n                                    \"line_number\": 476,\n                                    \"matched_data\": \"os.environ[\",\n                                    \"matched_length\": 11,\n                                    \"offset\": 21\n                                },\n                                {\n                                    \"line\": \"                \\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '0'\\\\n\\\"\\n\",\n                                    \"line_number\": 477,\n                                    \"matched_data\": \"os.environ[\",\n                                    \"matched_length\": 11,\n                                    \"offset\": 21\n                                },\n                                {\n                                    \"line\": \"                \\\"                os.environ['HF_TOKEN'] = orig_hf_token\\\\n\\\"\\n\",\n                                    \"line_number\": 510,\n                                    \"matched_data\": \"os.environ[\",\n                                    \"matched_length\": 11,\n                                    \"offset\": 33\n                                },\n                                {\n                                    \"line\": \"            \\\"os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\n\\\"\\n\",\n                                    \"line_number\": 984,\n                                    \"matched_data\": \"os.environ[\",\n                                    \"matched_length\": 11,\n                                    \"offset\": 13\n                                },\n                                {\n                                    \"line\": \"            \\\"os.environ['HF_HUB_ENABLE_HF_XET'] = '0'\\\\n\\\"\\n\",\n                                    \"line_number\": 985,\n                                    \"matched_data\": \"os.environ[\",\n                                    \"matched_length\": 11,\n                                    \"offset\": 13\n                                }\n                            ]\n                        },\n                        {\n                            \"identifier\": \"$env_read3\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"token_override = os.getenv(\\\"HF_TOKEN\\\")\\n\",\n                                    \"line_number\": 29,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 17\n                                },\n                                {\n                                    \"line\": \"_sha_max_env = os.getenv(\\\"HF_DOWNLOADER_SHA_MAX_BYTES\\\", \\\"0\\\")\\n\",\n                                    \"line_number\": 30,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 15\n                                },\n                                {\n                                    \"line\": \"    value = os.getenv(name)\\n\",\n                                    \"line_number\": 38,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 12\n                                },\n                                {\n                                    \"line\": \"        token = os.getenv(\\\"HF_TOKEN\\\", \\\"\\\").strip()\\n\",\n                                    \"line_number\": 185,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 16\n                                }\n                            ]\n                        },\n                        {\n                            \"identifier\": \"$env_mod1\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"                \\\"    os.environ['HF_HUB_DISABLE_XET'] = '0'\\\\n\\\"\\n\",\n                                    \"line_number\": 473,\n                                    \"matched_data\": \"os.environ['HF_HUB_DISABLE_XET'] =\",\n                                    \"matched_length\": 34,\n                                    \"offset\": 21\n                                },\n                                {\n                                    \"line\": \"                \\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '1'\\\\n\\\"\\n\",\n                                    \"line_number\": 474,\n                                    \"matched_data\": \"os.environ['HF_HUB_ENABLE_HF_XET'] =\",\n                                    \"matched_length\": 36,\n                                    \"offset\": 21\n                                },\n                                {\n                                    \"line\": \"                \\\"    os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\n\\\"\\n\",\n                                    \"line_number\": 476,\n                                    \"matched_data\": \"os.environ['HF_HUB_DISABLE_XET'] =\",\n                                    \"matched_length\": 34,\n                                    \"offset\": 21\n                                },\n                                {\n                                    \"line\": \"                \\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '0'\\\\n\\\"\\n\",\n                                    \"line_number\": 477,\n                                    \"matched_data\": \"os.environ['HF_HUB_ENABLE_HF_XET'] =\",\n                                    \"matched_length\": 36,\n                                    \"offset\": 21\n                                },\n                                {\n                                    \"line\": \"                \\\"                os.environ['HF_TOKEN'] = orig_hf_token\\\\n\\\"\\n\",\n                                    \"line_number\": 510,\n                                    \"matched_data\": \"os.environ['HF_TOKEN'] =\",\n                                    \"matched_length\": 24,\n                                    \"offset\": 33\n                                },\n                                {\n                                    \"line\": \"            \\\"os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\n\\\"\\n\",\n                                    \"line_number\": 984,\n                                    \"matched_data\": \"os.environ['HF_HUB_DISABLE_XET'] =\",\n                                    \"matched_length\": 34,\n                                    \"offset\": 13\n                                },\n                                {\n                                    \"line\": \"            \\\"os.environ['HF_HUB_ENABLE_HF_XET'] = '0'\\\\n\\\"\\n\",\n                                    \"line_number\": 985,\n                                    \"matched_data\": \"os.environ['HF_HUB_ENABLE_HF_XET'] =\",\n                                    \"matched_length\": 36,\n                                    \"offset\": 13\n                                }\n                            ]\n                        },\n                        {\n                            \"identifier\": \"$env_mod4\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"                \\\"        orig_hf_token = os.environ.pop('HF_TOKEN', None)\\\\n\\\"\\n\",\n                                    \"line_number\": 504,\n                                    \"matched_data\": \"os.environ.pop(\",\n                                    \"matched_length\": 15,\n                                    \"offset\": 41\n                                }\n                            ]\n                        }\n                    ]\n                }\n            ],\n            \"yara_meta\": {\n                \"attack_id1\": \"T1574.007 Environment Variable Hijacking\",\n                \"category\": \"Defense Evasion\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects environment variable manipulation and reading\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1574/007/\",\n                \"severity\": \"3\",\n                \"version\": \"1.0\"\n            }\n        },\n        \"recommendation\": \"\",\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    },\n    {\n        \"admin_tags\": [\n            \"system-modification\"\n        ],\n        \"code_snippet\": \"44 | _nunchaku_blackwell_cache: bool | None = None\\n45 | _node_widget_schema_hints_cache: dict[str, list[dict[str, Any]]] | None = None\\n46 | \\n47 | HF_SEARCH_MAX_CALLS = int(os.getenv(\\\"HF_SEARCH_MAX_CALLS\\\", \\\"200\\\"))\\n48 | HF_SEARCH_RATE_LIMIT_SECONDS = int(os.getenv(\\\"HF_SEARCH_RATE_LIMIT_SECONDS\\\", \\\"300\\\"))\\n49 | HF_SEARCH_MAX_SECONDS = int(os.getenv(\\\"HF_SEARCH_MAX_SECONDS\\\", \\\"60\\\"))\\n50 | HF_SEARCH_CALL_TIMEOUT = int(os.getenv(\\\"HF_SEARCH_CALL_TIMEOUT\\\", \\\"20\\\"))\",\n        \"description\": \"Detects environment variable manipulation and reading\",\n        \"file_path\": \"model_discovery.py\",\n        \"issue_type\": \"python_environment_manipulation\",\n        \"line_number\": 47,\n        \"line_snippet\": \"HF_SEARCH_MAX_CALLS = int(os.getenv(\\\"HF_SEARCH_MAX_CALLS\\\", \\\"200\\\"))\",\n        \"metadata\": {\n            \"confidence\": 90,\n            \"matched_patterns\": [\n                \"$env_read3\"\n            ],\n            \"yara_matches\": [\n                {\n                    \"filepath\": \"model_discovery.py\",\n                    \"strings\": [\n                        {\n                            \"identifier\": \"$env_read3\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"HF_SEARCH_MAX_CALLS = int(os.getenv(\\\"HF_SEARCH_MAX_CALLS\\\", \\\"200\\\"))\\n\",\n                                    \"line_number\": 47,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 26\n                                },\n                                {\n                                    \"line\": \"HF_SEARCH_RATE_LIMIT_SECONDS = int(os.getenv(\\\"HF_SEARCH_RATE_LIMIT_SECONDS\\\", \\\"300\\\"))\\n\",\n                                    \"line_number\": 48,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 35\n                                },\n                                {\n                                    \"line\": \"HF_SEARCH_MAX_SECONDS = int(os.getenv(\\\"HF_SEARCH_MAX_SECONDS\\\", \\\"60\\\"))\\n\",\n                                    \"line_number\": 49,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 28\n                                },\n                                {\n                                    \"line\": \"HF_SEARCH_CALL_TIMEOUT = int(os.getenv(\\\"HF_SEARCH_CALL_TIMEOUT\\\", \\\"20\\\"))\\n\",\n                                    \"line_number\": 50,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 29\n                                },\n                                {\n                                    \"line\": \"PRIORITY_REPO_SCAN_LIMIT = int(os.getenv(\\\"HF_PRIORITY_REPO_SCAN_LIMIT\\\", \\\"100\\\"))\\n\",\n                                    \"line_number\": 51,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 31\n                                },\n                                {\n                                    \"line\": \"HF_URL_CHECK_TIMEOUT = int(os.getenv(\\\"HF_URL_CHECK_TIMEOUT\\\", \\\"8\\\"))\\n\",\n                                    \"line_number\": 52,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 27\n                                }\n                            ]\n                        }\n                    ]\n                }\n            ],\n            \"yara_meta\": {\n                \"attack_id1\": \"T1574.007 Environment Variable Hijacking\",\n                \"category\": \"Defense Evasion\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects environment variable manipulation and reading\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1574/007/\",\n                \"severity\": \"3\",\n                \"version\": \"1.0\"\n            }\n        },\n        \"recommendation\": \"\",\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    },\n    {\n        \"admin_tags\": [\n            \"system-modification\"\n        ],\n        \"code_snippet\": \"2650 |             return repo\\n2651 |     except Exception:\\n2652 |         pass\\n2653 |     return os.getenv(\\\"COMFYUI_BACKUP\\\", \\\"\\\").strip()\\n2654 | \\n2655 | \\n2656 | def _parse_size_limit(value, default=5.0) -\\u003e float:\",\n        \"description\": \"Detects environment variable manipulation and reading\",\n        \"file_path\": \"web_api.py\",\n        \"issue_type\": \"python_environment_manipulation\",\n        \"line_number\": 2653,\n        \"line_snippet\": \"return os.getenv(\\\"COMFYUI_BACKUP\\\", \\\"\\\").strip()\",\n        \"metadata\": {\n            \"confidence\": 90,\n            \"matched_patterns\": [\n                \"$env_read3\"\n            ],\n            \"yara_matches\": [\n                {\n                    \"filepath\": \"web_api.py\",\n                    \"strings\": [\n                        {\n                            \"identifier\": \"$env_read3\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"    return os.getenv(\\\"COMFYUI_BACKUP\\\", \\\"\\\").strip()\\n\",\n                                    \"line_number\": 2653,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 11\n                                },\n                                {\n                                    \"line\": \"        runpod_id = os.getenv(\\\"RUNPOD_POD_ID\\\", \\\"\\\").strip()\\n\",\n                                    \"line_number\": 2682,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 20\n                                },\n                                {\n                                    \"line\": \"        comfyui_backup_env = os.getenv(\\\"COMFYUI_BACKUP\\\", \\\"\\\").strip()\\n\",\n                                    \"line_number\": 2684,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 29\n                                }\n                            ]\n                        }\n                    ]\n                }\n            ],\n            \"yara_meta\": {\n                \"attack_id1\": \"T1574.007 Environment Variable Hijacking\",\n                \"category\": \"Defense Evasion\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects environment variable manipulation and reading\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1574/007/\",\n                \"severity\": \"3\",\n                \"version\": \"1.0\"\n            }\n        },\n        \"recommendation\": \"\",\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    },\n    {\n        \"admin_tags\": [\n            \"any-code-execute\"\n        ],\n        \"code_snippet\": \"651 |             env = os.environ.copy()\\n652 |             env[\\\"COMFYUI_PATH\\\"] = comfy_dir\\n653 | \\n654 |             process = subprocess.run(\\n655 |                 [sys.executable, manager_cli_script, \\\"save-snapshot\\\"],\\n656 |                 capture_output=True,\\n657 |                 text=True,\",\n        \"description\": \"Detects all os.system and subprocess usage for potential command injection vulnerabilities\",\n        \"file_path\": \"backup.py\",\n        \"issue_type\": \"python_command_injection_risk\",\n        \"line_number\": 654,\n        \"line_snippet\": \"process = subprocess.run(\",\n        \"metadata\": {\n            \"attack_id\": [\n                \"T1059.004 Unix Shell\"\n            ],\n            \"confidence\": 95,\n            \"matched_patterns\": [\n                \"$subprocess_run_direct\"\n            ],\n            \"reference\": \"https://attack.mitre.org/techniques/T1059/004/\",\n            \"yara_meta\": {\n                \"attack_id1\": \"T1059.004 Unix Shell\",\n                \"category\": \"Injection\",\n                \"confidence_note\": \"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects all os.system and subprocess usage for potential command injection vulnerabilities\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1059/004/\",\n                \"severity\": \"4\",\n                \"traceability\": \"CIR-001..006\",\n                \"version\": \"1.1\"\n            },\n            \"yara_rule\": \"python_command_injection_risk\"\n        },\n        \"recommendation\": null,\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    },\n    {\n        \"admin_tags\": [\n            \"any-code-execute\",\n            \"any-folder-access\"\n        ],\n        \"code_snippet\": \"560 |                     with open(payload_path, \\\"w\\\", encoding=\\\"utf-8\\\") as f:\\n561 |                         json.dump(download_kwargs, f)\\n562 | \\n563 |                     proc = subprocess.Popen(\\n564 |                         [sys.executable, \\\"-u\\\", \\\"-c\\\", script, payload_path, result_path, xet_flag],\\n565 |                         stdout=subprocess.PIPE,\\n566 |                         stderr=subprocess.STDOUT,\",\n        \"description\": \"Detects all os.system and subprocess usage for potential command injection vulnerabilities\",\n        \"file_path\": \"downloader.py\",\n        \"issue_type\": \"python_command_injection_risk\",\n        \"line_number\": 563,\n        \"line_snippet\": \"proc = subprocess.Popen(\",\n        \"metadata\": {\n            \"attack_id\": [\n                \"T1059.004 Unix Shell\"\n            ],\n            \"confidence\": 95,\n            \"matched_patterns\": [\n                \"$subprocess_popen_direct\"\n            ],\n            \"reference\": \"https://attack.mitre.org/techniques/T1059/004/\",\n            \"yara_meta\": {\n                \"attack_id1\": \"T1059.004 Unix Shell\",\n                \"category\": \"Injection\",\n                \"confidence_note\": \"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects all os.system and subprocess usage for potential command injection vulnerabilities\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1059/004/\",\n                \"severity\": \"4\",\n                \"traceability\": \"CIR-001..006\",\n                \"version\": \"1.1\"\n            },\n            \"yara_rule\": \"python_command_injection_risk\"\n        },\n        \"recommendation\": null,\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    },\n    {\n        \"admin_tags\": [\n            \"any-code-execute\",\n            \"any-folder-access\"\n        ],\n        \"code_snippet\": \"1014 |             with open(payload_path, \\\"w\\\", encoding=\\\"utf-8\\\") as f:\\n1015 |                 json.dump(download_kwargs, f)\\n1016 | \\n1017 |             proc = subprocess.Popen(\\n1018 |                 [sys.executable, \\\"-u\\\", \\\"-c\\\", script, payload_path, result_path],\\n1019 |                 stdout=subprocess.PIPE,\\n1020 |                 stderr=subprocess.STDOUT,\",\n        \"description\": \"Detects all os.system and subprocess usage for potential command injection vulnerabilities\",\n        \"file_path\": \"downloader.py\",\n        \"issue_type\": \"python_command_injection_risk\",\n        \"line_number\": 1017,\n        \"line_snippet\": \"proc = subprocess.Popen(\",\n        \"metadata\": {\n            \"attack_id\": [\n                \"T1059.004 Unix Shell\"\n            ],\n            \"confidence\": 95,\n            \"matched_patterns\": [\n                \"$subprocess_popen_direct\"\n            ],\n            \"reference\": \"https://attack.mitre.org/techniques/T1059/004/\",\n            \"yara_meta\": {\n                \"attack_id1\": \"T1059.004 Unix Shell\",\n                \"category\": \"Injection\",\n                \"confidence_note\": \"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects all os.system and subprocess usage for potential command injection vulnerabilities\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1059/004/\",\n                \"severity\": \"4\",\n                \"traceability\": \"CIR-001..006\",\n                \"version\": \"1.1\"\n            },\n            \"yara_rule\": \"python_command_injection_risk\"\n        },\n        \"recommendation\": null,\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    },\n    {\n        \"admin_tags\": [\n            \"any-network-requests\"\n        ],\n        \"code_snippet\": \"753 |                 status_cb(\\\"downloading\\\")\\n754 | \\n755 |             request = urllib.request.Request(raw_url, headers=request_headers, method=\\\"GET\\\")\\n756 |             with urllib.request.urlopen(request, timeout=60) as response:\\n757 |                 final_url = str(getattr(response, \\\"geturl\\\", lambda: raw_url)() or raw_url)\\n758 |                 headers = getattr(response, \\\"headers\\\", {})\\n759 |                 content_disposition = \\\"\\\"\",\n        \"description\": \"Detects network operations and potential data exfiltration patterns\",\n        \"file_path\": \"downloader.py\",\n        \"issue_type\": \"python_network_operations\",\n        \"line_number\": 756,\n        \"line_snippet\": \"with urllib.request.urlopen(request, timeout=60) as response:\",\n        \"metadata\": {\n            \"confidence\": 90,\n            \"matched_patterns\": [\n                \"$http2\"\n            ],\n            \"yara_matches\": [\n                {\n                    \"filepath\": \"downloader.py\",\n                    \"strings\": [\n                        {\n                            \"identifier\": \"$http2\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"            with urllib.request.urlopen(request, timeout=60) as response:\\n\",\n                                    \"line_number\": 756,\n                                    \"matched_data\": \"urllib.request.urlopen(\",\n                                    \"matched_length\": 23,\n                                    \"offset\": 17\n                                }\n                            ]\n                        }\n                    ]\n                }\n            ],\n            \"yara_meta\": {\n                \"attack_id1\": \"T1041 Exfiltration Over C2 Channel\",\n                \"attack_id2\": \"T1048 Exfiltration Over Alternative Protocol\",\n                \"category\": \"Exfiltration\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects network operations and potential data exfiltration patterns\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1041/\",\n                \"severity\": \"3\",\n                \"version\": \"1.0\"\n            }\n        },\n        \"recommendation\": \"\",\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    },\n    {\n        \"admin_tags\": [\n            \"any-network-requests\"\n        ],\n        \"code_snippet\": \"360 |         if extra_headers:\\n361 |             req_headers.update(extra_headers)\\n362 |         req = urllib.request.Request(url, method=method, headers=req_headers)\\n363 |         with urllib.request.urlopen(req, timeout=HF_URL_CHECK_TIMEOUT) as resp:\\n364 |             code = getattr(resp, \\\"status\\\", None) or resp.getcode()\\n365 |             return 200 \\u003c= int(code) \\u003c 400\\n366 | \",\n        \"description\": \"Detects network operations and potential data exfiltration patterns\",\n        \"file_path\": \"model_discovery.py\",\n        \"issue_type\": \"python_network_operations\",\n        \"line_number\": 363,\n        \"line_snippet\": \"with urllib.request.urlopen(req, timeout=HF_URL_CHECK_TIMEOUT) as resp:\",\n        \"metadata\": {\n            \"confidence\": 90,\n            \"matched_patterns\": [\n                \"$http2\"\n            ],\n            \"yara_matches\": [\n                {\n                    \"filepath\": \"model_discovery.py\",\n                    \"strings\": [\n                        {\n                            \"identifier\": \"$http2\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"        with urllib.request.urlopen(req, timeout=HF_URL_CHECK_TIMEOUT) as resp:\\n\",\n                                    \"line_number\": 363,\n                                    \"matched_data\": \"urllib.request.urlopen(\",\n                                    \"matched_length\": 23,\n                                    \"offset\": 13\n                                }\n                            ]\n                        }\n                    ]\n                }\n            ],\n            \"yara_meta\": {\n                \"attack_id1\": \"T1041 Exfiltration Over C2 Channel\",\n                \"attack_id2\": \"T1048 Exfiltration Over Alternative Protocol\",\n                \"category\": \"Exfiltration\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects network operations and potential data exfiltration patterns\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1041/\",\n                \"severity\": \"3\",\n                \"version\": \"1.0\"\n            }\n        },\n        \"recommendation\": \"\",\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    },\n    {\n        \"admin_tags\": [\n            \"any-network-requests\"\n        ],\n        \"code_snippet\": \"6820 |             }\\n6821 | \\n6822 |             const originalLoadGraphData = comfyApp.loadGraphData.bind(comfyApp);\\n6823 |             comfyApp.loadGraphData = async (...args) =\\u003e {\\n6824 |                 const loadedGraphData = normalizeWorkflowOpenGraphDataArg(args?.[0]);\\n6825 |                 workflowOpenLastTriggeredAt = 0;\\n6826 |                 workflowOpenLastHandledSignature = \\\"\\\";\",\n        \"description\": \"Detects network operations and potential data exfiltration patterns\",\n        \"file_path\": \"js/auto_download.js\",\n        \"issue_type\": \"python_network_operations\",\n        \"line_number\": 6823,\n        \"line_snippet\": \"comfyApp.loadGraphData = async (...args) =\\u003e {\",\n        \"metadata\": {\n            \"confidence\": 90,\n            \"matched_patterns\": [\n                \"$socket4\"\n            ],\n            \"yara_matches\": [\n                {\n                    \"filepath\": \"js/auto_download.js\",\n                    \"strings\": [\n                        {\n                            \"identifier\": \"$socket4\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"            comfyApp.loadGraphData = async (...args) =\\u003e {\\n\",\n                                    \"line_number\": 6823,\n                                    \"matched_data\": \".bind(\",\n                                    \"matched_length\": 6,\n                                    \"offset\": 2\n                                },\n                                {\n                                    \"line\": \"                executionErrorStore.surfaceMissingModels.bind(executionErrorStore);\\n\",\n                                    \"line_number\": 6941,\n                                    \"matched_data\": \".bind(\",\n                                    \"matched_length\": 6,\n                                    \"offset\": 75\n                                }\n                            ]\n                        }\n                    ]\n                }\n            ],\n            \"yara_meta\": {\n                \"attack_id1\": \"T1041 Exfiltration Over C2 Channel\",\n                \"attack_id2\": \"T1048 Exfiltration Over Alternative Protocol\",\n                \"category\": \"Exfiltration\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects network operations and potential data exfiltration patterns\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1041/\",\n                \"severity\": \"3\",\n                \"version\": \"1.0\"\n            }\n        },\n        \"recommendation\": \"\",\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    }\n]","supported_accelerators":[],"supported_comfyui_frontend_version":"","supported_comfyui_version":"","supported_os":[],"tags":[],"tags_admin":[],"version":"1.34.21"},{"changelog":"","comfy_node_extract_status":"pending","createdAt":"2026-09-10T11:16:51.624536Z","dependencies":["huggingface_hub\u003e=0.20.0"],"deprecated":false,"downloadUrl":"https://cdn.comfy.org/jnx/ComfyUI_HuggingFace_Downloader/1.34.20/node.zip","id":"efa559ff-7d28-4e9f-be15-b03430c3a677","node_id":"ComfyUI_HuggingFace_Downloader","status":"NodeVersionStatusFlagged","status_reason":"[\n    {\n        \"admin_tags\": [\n            \"credential-access\",\n            \"system-modification\"\n        ],\n        \"code_snippet\": \"25 |                         pass\\n26 |                     finally:\\n27 |                         if orig_env_token is not None:\\n28 |                             os.environ[\\\"HF_TOKEN\\\"] = orig_env_token\\n29 |             raise e\\n30 | \\n31 |     huggingface_hub.file_download.hf_hub_download = _patched_hf_hub_download\",\n        \"description\": \"Detects environment variable manipulation and reading\",\n        \"file_path\": \"__init__.py\",\n        \"issue_type\": \"python_environment_manipulation\",\n        \"line_number\": 28,\n        \"line_snippet\": \"os.environ[\\\"HF_TOKEN\\\"] = orig_env_token\",\n        \"metadata\": {\n            \"confidence\": 90,\n            \"matched_patterns\": [\n                \"$env_read1\",\n                \"$env_mod1\",\n                \"$env_mod4\"\n            ],\n            \"yara_matches\": [\n                {\n                    \"filepath\": \"__init__.py\",\n                    \"strings\": [\n                        {\n                            \"identifier\": \"$env_read1\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"                            os.environ[\\\"HF_TOKEN\\\"] = orig_env_token\\n\",\n                                    \"line_number\": 28,\n                                    \"matched_data\": \"os.environ[\",\n                                    \"matched_length\": 11,\n                                    \"offset\": 28\n                                }\n                            ]\n                        },\n                        {\n                            \"identifier\": \"$env_mod1\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"                            os.environ[\\\"HF_TOKEN\\\"] = orig_env_token\\n\",\n                                    \"line_number\": 28,\n                                    \"matched_data\": \"os.environ[\\\"HF_TOKEN\\\"] =\",\n                                    \"matched_length\": 24,\n                                    \"offset\": 28\n                                }\n                            ]\n                        },\n                        {\n                            \"identifier\": \"$env_mod4\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"                    orig_env_token = os.environ.pop(\\\"HF_TOKEN\\\", None)\\n\",\n                                    \"line_number\": 21,\n                                    \"matched_data\": \"os.environ.pop(\",\n                                    \"matched_length\": 15,\n                                    \"offset\": 37\n                                }\n                            ]\n                        }\n                    ]\n                }\n            ],\n            \"yara_meta\": {\n                \"attack_id1\": \"T1574.007 Environment Variable Hijacking\",\n                \"category\": \"Defense Evasion\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects environment variable manipulation and reading\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1574/007/\",\n                \"severity\": \"3\",\n                \"version\": \"1.0\"\n            }\n        },\n        \"recommendation\": \"\",\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    },\n    {\n        \"admin_tags\": [\n            \"system-modification\"\n        ],\n        \"code_snippet\": \"1024 |     Uses snapshot_download for faster parallel downloads.\\n1025 |     \\\"\\\"\\\"\\n1026 |     # Must be set BEFORE importing huggingface_hub so hf_xet reads it at import time.\\n1027 |     os.environ[\\\"HF_HUB_ENABLE_HF_XET\\\"] = \\\"0\\\"\\n1028 |     os.environ[\\\"HF_HUB_DISABLE_XET\\\"] = \\\"1\\\"\\n1029 | \\n1030 |     from huggingface_hub import snapshot_download, hf_hub_download\",\n        \"description\": \"Detects environment variable manipulation and reading\",\n        \"file_path\": \"backup.py\",\n        \"issue_type\": \"python_environment_manipulation\",\n        \"line_number\": 1027,\n        \"line_snippet\": \"os.environ[\\\"HF_HUB_ENABLE_HF_XET\\\"] = \\\"0\\\"\",\n        \"metadata\": {\n            \"confidence\": 90,\n            \"matched_patterns\": [\n                \"$env_read1\",\n                \"$env_read3\",\n                \"$env_mod1\",\n                \"$proc_env1\"\n            ],\n            \"yara_matches\": [\n                {\n                    \"filepath\": \"backup.py\",\n                    \"strings\": [\n                        {\n                            \"identifier\": \"$env_read1\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"    os.environ[\\\"HF_HUB_ENABLE_HF_XET\\\"] = \\\"0\\\"\\n\",\n                                    \"line_number\": 1027,\n                                    \"matched_data\": \"os.environ[\",\n                                    \"matched_length\": 11,\n                                    \"offset\": 4\n                                },\n                                {\n                                    \"line\": \"    os.environ[\\\"HF_HUB_DISABLE_XET\\\"] = \\\"1\\\"\\n\",\n                                    \"line_number\": 1028,\n                                    \"matched_data\": \"os.environ[\",\n                                    \"matched_length\": 11,\n                                    \"offset\": 4\n                                }\n                            ]\n                        },\n                        {\n                            \"identifier\": \"$env_read3\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"        token = os.getenv(\\\"HF_TOKEN\\\", \\\"\\\").strip()\\n\",\n                                    \"line_number\": 495,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 16\n                                }\n                            ]\n                        },\n                        {\n                            \"identifier\": \"$env_mod1\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"    os.environ[\\\"HF_HUB_ENABLE_HF_XET\\\"] = \\\"0\\\"\\n\",\n                                    \"line_number\": 1027,\n                                    \"matched_data\": \"os.environ[\\\"HF_HUB_ENABLE_HF_XET\\\"] =\",\n                                    \"matched_length\": 36,\n                                    \"offset\": 4\n                                },\n                                {\n                                    \"line\": \"    os.environ[\\\"HF_HUB_DISABLE_XET\\\"] = \\\"1\\\"\\n\",\n                                    \"line_number\": 1028,\n                                    \"matched_data\": \"os.environ[\\\"HF_HUB_DISABLE_XET\\\"] =\",\n                                    \"matched_length\": 34,\n                                    \"offset\": 4\n                                }\n                            ]\n                        },\n                        {\n                            \"identifier\": \"$proc_env1\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"            process = subprocess.run(\\n\",\n                                    \"line_number\": 654,\n                                    \"matched_data\": \"subprocess.run(\\n                [sys.executable, manager_cli_script, \\\"save-snapshot\\\"],\\n                capture_output=True,\\n                text=True,\\n                cwd=comfy_dir,\\n                env=\",\n                                    \"matched_length\": 202,\n                                    \"offset\": 22\n                                }\n                            ]\n                        }\n                    ]\n                }\n            ],\n            \"yara_meta\": {\n                \"attack_id1\": \"T1574.007 Environment Variable Hijacking\",\n                \"category\": \"Defense Evasion\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects environment variable manipulation and reading\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1574/007/\",\n                \"severity\": \"3\",\n                \"version\": \"1.0\"\n            }\n        },\n        \"recommendation\": \"\",\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    },\n    {\n        \"admin_tags\": [\n            \"any-network-requests\",\n            \"system-modification\"\n        ],\n        \"code_snippet\": \"470 |                 \\\"import json, sys, os, urllib.request, shutil\\\\n\\\"\\n471 |                 \\\"use_xet = sys.argv[3] == '1'\\\\n\\\"\\n472 |                 \\\"if use_xet:\\\\n\\\"\\n473 |                 \\\"    os.environ['HF_HUB_DISABLE_XET'] = '0'\\\\n\\\"\\n474 |                 \\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '1'\\\\n\\\"\\n475 |                 \\\"else:\\\\n\\\"\\n476 |                 \\\"    os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\n\\\"\",\n        \"description\": \"Detects environment variable manipulation and reading\",\n        \"file_path\": \"downloader.py\",\n        \"issue_type\": \"python_environment_manipulation\",\n        \"line_number\": 473,\n        \"line_snippet\": \"\\\"    os.environ['HF_HUB_DISABLE_XET'] = '0'\\\\n\\\"\",\n        \"metadata\": {\n            \"confidence\": 90,\n            \"matched_patterns\": [\n                \"$env_read1\",\n                \"$env_read3\",\n                \"$env_mod1\",\n                \"$env_mod4\"\n            ],\n            \"yara_matches\": [\n                {\n                    \"filepath\": \"downloader.py\",\n                    \"strings\": [\n                        {\n                            \"identifier\": \"$env_read1\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"                \\\"    os.environ['HF_HUB_DISABLE_XET'] = '0'\\\\n\\\"\\n\",\n                                    \"line_number\": 473,\n                                    \"matched_data\": \"os.environ[\",\n                                    \"matched_length\": 11,\n                                    \"offset\": 21\n                                },\n                                {\n                                    \"line\": \"                \\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '1'\\\\n\\\"\\n\",\n                                    \"line_number\": 474,\n                                    \"matched_data\": \"os.environ[\",\n                                    \"matched_length\": 11,\n                                    \"offset\": 21\n                                },\n                                {\n                                    \"line\": \"                \\\"    os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\n\\\"\\n\",\n                                    \"line_number\": 476,\n                                    \"matched_data\": \"os.environ[\",\n                                    \"matched_length\": 11,\n                                    \"offset\": 21\n                                },\n                                {\n                                    \"line\": \"                \\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '0'\\\\n\\\"\\n\",\n                                    \"line_number\": 477,\n                                    \"matched_data\": \"os.environ[\",\n                                    \"matched_length\": 11,\n                                    \"offset\": 21\n                                },\n                                {\n                                    \"line\": \"                \\\"                os.environ['HF_TOKEN'] = orig_hf_token\\\\n\\\"\\n\",\n                                    \"line_number\": 510,\n                                    \"matched_data\": \"os.environ[\",\n                                    \"matched_length\": 11,\n                                    \"offset\": 33\n                                },\n                                {\n                                    \"line\": \"            \\\"os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\n\\\"\\n\",\n                                    \"line_number\": 984,\n                                    \"matched_data\": \"os.environ[\",\n                                    \"matched_length\": 11,\n                                    \"offset\": 13\n                                },\n                                {\n                                    \"line\": \"            \\\"os.environ['HF_HUB_ENABLE_HF_XET'] = '0'\\\\n\\\"\\n\",\n                                    \"line_number\": 985,\n                                    \"matched_data\": \"os.environ[\",\n                                    \"matched_length\": 11,\n                                    \"offset\": 13\n                                }\n                            ]\n                        },\n                        {\n                            \"identifier\": \"$env_read3\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"token_override = os.getenv(\\\"HF_TOKEN\\\")\\n\",\n                                    \"line_number\": 29,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 17\n                                },\n                                {\n                                    \"line\": \"_sha_max_env = os.getenv(\\\"HF_DOWNLOADER_SHA_MAX_BYTES\\\", \\\"0\\\")\\n\",\n                                    \"line_number\": 30,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 15\n                                },\n                                {\n                                    \"line\": \"    value = os.getenv(name)\\n\",\n                                    \"line_number\": 38,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 12\n                                },\n                                {\n                                    \"line\": \"        token = os.getenv(\\\"HF_TOKEN\\\", \\\"\\\").strip()\\n\",\n                                    \"line_number\": 185,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 16\n                                }\n                            ]\n                        },\n                        {\n                            \"identifier\": \"$env_mod1\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"                \\\"    os.environ['HF_HUB_DISABLE_XET'] = '0'\\\\n\\\"\\n\",\n                                    \"line_number\": 473,\n                                    \"matched_data\": \"os.environ['HF_HUB_DISABLE_XET'] =\",\n                                    \"matched_length\": 34,\n                                    \"offset\": 21\n                                },\n                                {\n                                    \"line\": \"                \\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '1'\\\\n\\\"\\n\",\n                                    \"line_number\": 474,\n                                    \"matched_data\": \"os.environ['HF_HUB_ENABLE_HF_XET'] =\",\n                                    \"matched_length\": 36,\n                                    \"offset\": 21\n                                },\n                                {\n                                    \"line\": \"                \\\"    os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\n\\\"\\n\",\n                                    \"line_number\": 476,\n                                    \"matched_data\": \"os.environ['HF_HUB_DISABLE_XET'] =\",\n                                    \"matched_length\": 34,\n                                    \"offset\": 21\n                                },\n                                {\n                                    \"line\": \"                \\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '0'\\\\n\\\"\\n\",\n                                    \"line_number\": 477,\n                                    \"matched_data\": \"os.environ['HF_HUB_ENABLE_HF_XET'] =\",\n                                    \"matched_length\": 36,\n                                    \"offset\": 21\n                                },\n                                {\n                                    \"line\": \"                \\\"                os.environ['HF_TOKEN'] = orig_hf_token\\\\n\\\"\\n\",\n                                    \"line_number\": 510,\n                                    \"matched_data\": \"os.environ['HF_TOKEN'] =\",\n                                    \"matched_length\": 24,\n                                    \"offset\": 33\n                                },\n                                {\n                                    \"line\": \"            \\\"os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\n\\\"\\n\",\n                                    \"line_number\": 984,\n                                    \"matched_data\": \"os.environ['HF_HUB_DISABLE_XET'] =\",\n                                    \"matched_length\": 34,\n                                    \"offset\": 13\n                                },\n                                {\n                                    \"line\": \"            \\\"os.environ['HF_HUB_ENABLE_HF_XET'] = '0'\\\\n\\\"\\n\",\n                                    \"line_number\": 985,\n                                    \"matched_data\": \"os.environ['HF_HUB_ENABLE_HF_XET'] =\",\n                                    \"matched_length\": 36,\n                                    \"offset\": 13\n                                }\n                            ]\n                        },\n                        {\n                            \"identifier\": \"$env_mod4\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"                \\\"        orig_hf_token = os.environ.pop('HF_TOKEN', None)\\\\n\\\"\\n\",\n                                    \"line_number\": 504,\n                                    \"matched_data\": \"os.environ.pop(\",\n                                    \"matched_length\": 15,\n                                    \"offset\": 41\n                                }\n                            ]\n                        }\n                    ]\n                }\n            ],\n            \"yara_meta\": {\n                \"attack_id1\": \"T1574.007 Environment Variable Hijacking\",\n                \"category\": \"Defense Evasion\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects environment variable manipulation and reading\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1574/007/\",\n                \"severity\": \"3\",\n                \"version\": \"1.0\"\n            }\n        },\n        \"recommendation\": \"\",\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    },\n    {\n        \"admin_tags\": [\n            \"system-modification\"\n        ],\n        \"code_snippet\": \"44 | _nunchaku_blackwell_cache: bool | None = None\\n45 | _node_widget_schema_hints_cache: dict[str, list[dict[str, Any]]] | None = None\\n46 | \\n47 | HF_SEARCH_MAX_CALLS = int(os.getenv(\\\"HF_SEARCH_MAX_CALLS\\\", \\\"200\\\"))\\n48 | HF_SEARCH_RATE_LIMIT_SECONDS = int(os.getenv(\\\"HF_SEARCH_RATE_LIMIT_SECONDS\\\", \\\"300\\\"))\\n49 | HF_SEARCH_MAX_SECONDS = int(os.getenv(\\\"HF_SEARCH_MAX_SECONDS\\\", \\\"60\\\"))\\n50 | HF_SEARCH_CALL_TIMEOUT = int(os.getenv(\\\"HF_SEARCH_CALL_TIMEOUT\\\", \\\"20\\\"))\",\n        \"description\": \"Detects environment variable manipulation and reading\",\n        \"file_path\": \"model_discovery.py\",\n        \"issue_type\": \"python_environment_manipulation\",\n        \"line_number\": 47,\n        \"line_snippet\": \"HF_SEARCH_MAX_CALLS = int(os.getenv(\\\"HF_SEARCH_MAX_CALLS\\\", \\\"200\\\"))\",\n        \"metadata\": {\n            \"confidence\": 90,\n            \"matched_patterns\": [\n                \"$env_read3\"\n            ],\n            \"yara_matches\": [\n                {\n                    \"filepath\": \"model_discovery.py\",\n                    \"strings\": [\n                        {\n                            \"identifier\": \"$env_read3\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"HF_SEARCH_MAX_CALLS = int(os.getenv(\\\"HF_SEARCH_MAX_CALLS\\\", \\\"200\\\"))\\n\",\n                                    \"line_number\": 47,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 26\n                                },\n                                {\n                                    \"line\": \"HF_SEARCH_RATE_LIMIT_SECONDS = int(os.getenv(\\\"HF_SEARCH_RATE_LIMIT_SECONDS\\\", \\\"300\\\"))\\n\",\n                                    \"line_number\": 48,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 35\n                                },\n                                {\n                                    \"line\": \"HF_SEARCH_MAX_SECONDS = int(os.getenv(\\\"HF_SEARCH_MAX_SECONDS\\\", \\\"60\\\"))\\n\",\n                                    \"line_number\": 49,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 28\n                                },\n                                {\n                                    \"line\": \"HF_SEARCH_CALL_TIMEOUT = int(os.getenv(\\\"HF_SEARCH_CALL_TIMEOUT\\\", \\\"20\\\"))\\n\",\n                                    \"line_number\": 50,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 29\n                                },\n                                {\n                                    \"line\": \"PRIORITY_REPO_SCAN_LIMIT = int(os.getenv(\\\"HF_PRIORITY_REPO_SCAN_LIMIT\\\", \\\"100\\\"))\\n\",\n                                    \"line_number\": 51,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 31\n                                },\n                                {\n                                    \"line\": \"HF_URL_CHECK_TIMEOUT = int(os.getenv(\\\"HF_URL_CHECK_TIMEOUT\\\", \\\"8\\\"))\\n\",\n                                    \"line_number\": 52,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 27\n                                }\n                            ]\n                        }\n                    ]\n                }\n            ],\n            \"yara_meta\": {\n                \"attack_id1\": \"T1574.007 Environment Variable Hijacking\",\n                \"category\": \"Defense Evasion\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects environment variable manipulation and reading\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1574/007/\",\n                \"severity\": \"3\",\n                \"version\": \"1.0\"\n            }\n        },\n        \"recommendation\": \"\",\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    },\n    {\n        \"admin_tags\": [\n            \"system-modification\"\n        ],\n        \"code_snippet\": \"2647 |             return repo\\n2648 |     except Exception:\\n2649 |         pass\\n2650 |     return os.getenv(\\\"COMFYUI_BACKUP\\\", \\\"\\\").strip()\\n2651 | \\n2652 | \\n2653 | def _parse_size_limit(value, default=5.0) -\\u003e float:\",\n        \"description\": \"Detects environment variable manipulation and reading\",\n        \"file_path\": \"web_api.py\",\n        \"issue_type\": \"python_environment_manipulation\",\n        \"line_number\": 2650,\n        \"line_snippet\": \"return os.getenv(\\\"COMFYUI_BACKUP\\\", \\\"\\\").strip()\",\n        \"metadata\": {\n            \"confidence\": 90,\n            \"matched_patterns\": [\n                \"$env_read3\"\n            ],\n            \"yara_matches\": [\n                {\n                    \"filepath\": \"web_api.py\",\n                    \"strings\": [\n                        {\n                            \"identifier\": \"$env_read3\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"    return os.getenv(\\\"COMFYUI_BACKUP\\\", \\\"\\\").strip()\\n\",\n                                    \"line_number\": 2650,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 11\n                                },\n                                {\n                                    \"line\": \"        runpod_id = os.getenv(\\\"RUNPOD_POD_ID\\\", \\\"\\\").strip()\\n\",\n                                    \"line_number\": 2679,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 20\n                                },\n                                {\n                                    \"line\": \"        comfyui_backup_env = os.getenv(\\\"COMFYUI_BACKUP\\\", \\\"\\\").strip()\\n\",\n                                    \"line_number\": 2681,\n                                    \"matched_data\": \"os.getenv(\",\n                                    \"matched_length\": 10,\n                                    \"offset\": 29\n                                }\n                            ]\n                        }\n                    ]\n                }\n            ],\n            \"yara_meta\": {\n                \"attack_id1\": \"T1574.007 Environment Variable Hijacking\",\n                \"category\": \"Defense Evasion\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects environment variable manipulation and reading\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1574/007/\",\n                \"severity\": \"3\",\n                \"version\": \"1.0\"\n            }\n        },\n        \"recommendation\": \"\",\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    },\n    {\n        \"admin_tags\": [\n            \"any-code-execute\"\n        ],\n        \"code_snippet\": \"651 |             env = os.environ.copy()\\n652 |             env[\\\"COMFYUI_PATH\\\"] = comfy_dir\\n653 | \\n654 |             process = subprocess.run(\\n655 |                 [sys.executable, manager_cli_script, \\\"save-snapshot\\\"],\\n656 |                 capture_output=True,\\n657 |                 text=True,\",\n        \"description\": \"Detects all os.system and subprocess usage for potential command injection vulnerabilities\",\n        \"file_path\": \"backup.py\",\n        \"issue_type\": \"python_command_injection_risk\",\n        \"line_number\": 654,\n        \"line_snippet\": \"process = subprocess.run(\",\n        \"metadata\": {\n            \"attack_id\": [\n                \"T1059.004 Unix Shell\"\n            ],\n            \"confidence\": 95,\n            \"matched_patterns\": [\n                \"$subprocess_run_direct\"\n            ],\n            \"reference\": \"https://attack.mitre.org/techniques/T1059/004/\",\n            \"yara_meta\": {\n                \"attack_id1\": \"T1059.004 Unix Shell\",\n                \"category\": \"Injection\",\n                \"confidence_note\": \"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects all os.system and subprocess usage for potential command injection vulnerabilities\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1059/004/\",\n                \"severity\": \"4\",\n                \"traceability\": \"CIR-001..006\",\n                \"version\": \"1.1\"\n            },\n            \"yara_rule\": \"python_command_injection_risk\"\n        },\n        \"recommendation\": null,\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    },\n    {\n        \"admin_tags\": [\n            \"any-code-execute\",\n            \"any-folder-access\"\n        ],\n        \"code_snippet\": \"560 |                     with open(payload_path, \\\"w\\\", encoding=\\\"utf-8\\\") as f:\\n561 |                         json.dump(download_kwargs, f)\\n562 | \\n563 |                     proc = subprocess.Popen(\\n564 |                         [sys.executable, \\\"-u\\\", \\\"-c\\\", script, payload_path, result_path, xet_flag],\\n565 |                         stdout=subprocess.PIPE,\\n566 |                         stderr=subprocess.STDOUT,\",\n        \"description\": \"Detects all os.system and subprocess usage for potential command injection vulnerabilities\",\n        \"file_path\": \"downloader.py\",\n        \"issue_type\": \"python_command_injection_risk\",\n        \"line_number\": 563,\n        \"line_snippet\": \"proc = subprocess.Popen(\",\n        \"metadata\": {\n            \"attack_id\": [\n                \"T1059.004 Unix Shell\"\n            ],\n            \"confidence\": 95,\n            \"matched_patterns\": [\n                \"$subprocess_popen_direct\"\n            ],\n            \"reference\": \"https://attack.mitre.org/techniques/T1059/004/\",\n            \"yara_meta\": {\n                \"attack_id1\": \"T1059.004 Unix Shell\",\n                \"category\": \"Injection\",\n                \"confidence_note\": \"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects all os.system and subprocess usage for potential command injection vulnerabilities\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1059/004/\",\n                \"severity\": \"4\",\n                \"traceability\": \"CIR-001..006\",\n                \"version\": \"1.1\"\n            },\n            \"yara_rule\": \"python_command_injection_risk\"\n        },\n        \"recommendation\": null,\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    },\n    {\n        \"admin_tags\": [\n            \"any-code-execute\",\n            \"any-folder-access\"\n        ],\n        \"code_snippet\": \"1014 |             with open(payload_path, \\\"w\\\", encoding=\\\"utf-8\\\") as f:\\n1015 |                 json.dump(download_kwargs, f)\\n1016 | \\n1017 |             proc = subprocess.Popen(\\n1018 |                 [sys.executable, \\\"-u\\\", \\\"-c\\\", script, payload_path, result_path],\\n1019 |                 stdout=subprocess.PIPE,\\n1020 |                 stderr=subprocess.STDOUT,\",\n        \"description\": \"Detects all os.system and subprocess usage for potential command injection vulnerabilities\",\n        \"file_path\": \"downloader.py\",\n        \"issue_type\": \"python_command_injection_risk\",\n        \"line_number\": 1017,\n        \"line_snippet\": \"proc = subprocess.Popen(\",\n        \"metadata\": {\n            \"attack_id\": [\n                \"T1059.004 Unix Shell\"\n            ],\n            \"confidence\": 95,\n            \"matched_patterns\": [\n                \"$subprocess_popen_direct\"\n            ],\n            \"reference\": \"https://attack.mitre.org/techniques/T1059/004/\",\n            \"yara_meta\": {\n                \"attack_id1\": \"T1059.004 Unix Shell\",\n                \"category\": \"Injection\",\n                \"confidence_note\": \"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects all os.system and subprocess usage for potential command injection vulnerabilities\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1059/004/\",\n                \"severity\": \"4\",\n                \"traceability\": \"CIR-001..006\",\n                \"version\": \"1.1\"\n            },\n            \"yara_rule\": \"python_command_injection_risk\"\n        },\n        \"recommendation\": null,\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    },\n    {\n        \"admin_tags\": [\n            \"any-network-requests\"\n        ],\n        \"code_snippet\": \"753 |                 status_cb(\\\"downloading\\\")\\n754 | \\n755 |             request = urllib.request.Request(raw_url, headers=request_headers, method=\\\"GET\\\")\\n756 |             with urllib.request.urlopen(request, timeout=60) as response:\\n757 |                 final_url = str(getattr(response, \\\"geturl\\\", lambda: raw_url)() or raw_url)\\n758 |                 headers = getattr(response, \\\"headers\\\", {})\\n759 |                 content_disposition = \\\"\\\"\",\n        \"description\": \"Detects network operations and potential data exfiltration patterns\",\n        \"file_path\": \"downloader.py\",\n        \"issue_type\": \"python_network_operations\",\n        \"line_number\": 756,\n        \"line_snippet\": \"with urllib.request.urlopen(request, timeout=60) as response:\",\n        \"metadata\": {\n            \"confidence\": 90,\n            \"matched_patterns\": [\n                \"$http2\"\n            ],\n            \"yara_matches\": [\n                {\n                    \"filepath\": \"downloader.py\",\n                    \"strings\": [\n                        {\n                            \"identifier\": \"$http2\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"            with urllib.request.urlopen(request, timeout=60) as response:\\n\",\n                                    \"line_number\": 756,\n                                    \"matched_data\": \"urllib.request.urlopen(\",\n                                    \"matched_length\": 23,\n                                    \"offset\": 17\n                                }\n                            ]\n                        }\n                    ]\n                }\n            ],\n            \"yara_meta\": {\n                \"attack_id1\": \"T1041 Exfiltration Over C2 Channel\",\n                \"attack_id2\": \"T1048 Exfiltration Over Alternative Protocol\",\n                \"category\": \"Exfiltration\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects network operations and potential data exfiltration patterns\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1041/\",\n                \"severity\": \"3\",\n                \"version\": \"1.0\"\n            }\n        },\n        \"recommendation\": \"\",\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    },\n    {\n        \"admin_tags\": [\n            \"any-network-requests\"\n        ],\n        \"code_snippet\": \"360 |         if extra_headers:\\n361 |             req_headers.update(extra_headers)\\n362 |         req = urllib.request.Request(url, method=method, headers=req_headers)\\n363 |         with urllib.request.urlopen(req, timeout=HF_URL_CHECK_TIMEOUT) as resp:\\n364 |             code = getattr(resp, \\\"status\\\", None) or resp.getcode()\\n365 |             return 200 \\u003c= int(code) \\u003c 400\\n366 | \",\n        \"description\": \"Detects network operations and potential data exfiltration patterns\",\n        \"file_path\": \"model_discovery.py\",\n        \"issue_type\": \"python_network_operations\",\n        \"line_number\": 363,\n        \"line_snippet\": \"with urllib.request.urlopen(req, timeout=HF_URL_CHECK_TIMEOUT) as resp:\",\n        \"metadata\": {\n            \"confidence\": 90,\n            \"matched_patterns\": [\n                \"$http2\"\n            ],\n            \"yara_matches\": [\n                {\n                    \"filepath\": \"model_discovery.py\",\n                    \"strings\": [\n                        {\n                            \"identifier\": \"$http2\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"        with urllib.request.urlopen(req, timeout=HF_URL_CHECK_TIMEOUT) as resp:\\n\",\n                                    \"line_number\": 363,\n                                    \"matched_data\": \"urllib.request.urlopen(\",\n                                    \"matched_length\": 23,\n                                    \"offset\": 13\n                                }\n                            ]\n                        }\n                    ]\n                }\n            ],\n            \"yara_meta\": {\n                \"attack_id1\": \"T1041 Exfiltration Over C2 Channel\",\n                \"attack_id2\": \"T1048 Exfiltration Over Alternative Protocol\",\n                \"category\": \"Exfiltration\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects network operations and potential data exfiltration patterns\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1041/\",\n                \"severity\": \"3\",\n                \"version\": \"1.0\"\n            }\n        },\n        \"recommendation\": \"\",\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    },\n    {\n        \"admin_tags\": [\n            \"any-network-requests\"\n        ],\n        \"code_snippet\": \"6820 |             }\\n6821 | \\n6822 |             const originalLoadGraphData = comfyApp.loadGraphData.bind(comfyApp);\\n6823 |             comfyApp.loadGraphData = async (...args) =\\u003e {\\n6824 |                 const loadedGraphData = normalizeWorkflowOpenGraphDataArg(args?.[0]);\\n6825 |                 workflowOpenLastTriggeredAt = 0;\\n6826 |                 workflowOpenLastHandledSignature = \\\"\\\";\",\n        \"description\": \"Detects network operations and potential data exfiltration patterns\",\n        \"file_path\": \"js/auto_download.js\",\n        \"issue_type\": \"python_network_operations\",\n        \"line_number\": 6823,\n        \"line_snippet\": \"comfyApp.loadGraphData = async (...args) =\\u003e {\",\n        \"metadata\": {\n            \"confidence\": 90,\n            \"matched_patterns\": [\n                \"$socket4\"\n            ],\n            \"yara_matches\": [\n                {\n                    \"filepath\": \"js/auto_download.js\",\n                    \"strings\": [\n                        {\n                            \"identifier\": \"$socket4\",\n                            \"instances\": [\n                                {\n                                    \"line\": \"            comfyApp.loadGraphData = async (...args) =\\u003e {\\n\",\n                                    \"line_number\": 6823,\n                                    \"matched_data\": \".bind(\",\n                                    \"matched_length\": 6,\n                                    \"offset\": 2\n                                },\n                                {\n                                    \"line\": \"                executionErrorStore.surfaceMissingModels.bind(executionErrorStore);\\n\",\n                                    \"line_number\": 6941,\n                                    \"matched_data\": \".bind(\",\n                                    \"matched_length\": 6,\n                                    \"offset\": 75\n                                }\n                            ]\n                        }\n                    ]\n                }\n            ],\n            \"yara_meta\": {\n                \"attack_id1\": \"T1041 Exfiltration Over C2 Channel\",\n                \"attack_id2\": \"T1048 Exfiltration Over Alternative Protocol\",\n                \"category\": \"Exfiltration\",\n                \"date\": \"2025-06-30\",\n                \"description\": \"Detects network operations and potential data exfiltration patterns\",\n                \"reference\": \"https://attack.mitre.org/techniques/T1041/\",\n                \"severity\": \"3\",\n                \"version\": \"1.0\"\n            }\n        },\n        \"recommendation\": \"\",\n        \"scanner\": \"yara_scan\",\n        \"severity\": \"info\"\n    }\n]","supported_accelerators":[],"supported_comfyui_frontend_version":"","supported_comfyui_version":"","supported_os":[],"tags":[],"tags_admin":[],"version":"1.34.20"},{"changelog":"","comfy_node_extract_status":"pending","createdAt":"2026-09-02T14:07:00.334061Z","dependencies":["huggingface_hub\u003e=0.20.0"],"deprecated":false,"downloadUrl":"https://cdn.comfy.org/jnx/ComfyUI_HuggingFace_Downloader/1.34.19/node.zip","id":"1d4f9064-289a-4910-b1d3-391392c9767f","node_id":"ComfyUI_HuggingFace_Downloader","status":"NodeVersionStatusBanned","status_reason":"{\"message\": \"policy-v0.3: path traversal / unconfined file side-effect (unauthenticated, CSRF-reachable) \\u2014 custom_path (free STRING widget) -\u003e final_folder -\u003e resolve_target_dir (absolute returned as-is at file_manager.py:160-161; relative joined with no '..' rejection at file_manager.py:224) -\u003e os.makedirs + write of attacker-downloaded bytes. Unconfined attacker-controlled write destination with attacker-controlled content. Same defect in HuggingFaceDownlo\\u2026 (downloader.py:417) [Rule 11]\", \"by\": \"drltdata@comfy.org\", \"statusHistory\": [{\"status\": \"NodeVersionStatusFlagged\", \"message\": \"[\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"credential-access\\\",\\n            \\\"system-modification\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"25 |                         pass\\\\n26 |                     finally:\\\\n27 |                         if orig_env_token is not None:\\\\n28 |                             os.environ[\\\\\\\"HF_TOKEN\\\\\\\"] = orig_env_token\\\\n29 |             raise e\\\\n30 | \\\\n31 |     huggingface_hub.file_download.hf_hub_download = _patched_hf_hub_download\\\",\\n        \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n        \\\"file_path\\\": \\\"__init__.py\\\",\\n        \\\"issue_type\\\": \\\"python_environment_manipulation\\\",\\n        \\\"line_number\\\": 28,\\n        \\\"line_snippet\\\": \\\"os.environ[\\\\\\\"HF_TOKEN\\\\\\\"] = orig_env_token\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$env_read1\\\",\\n                \\\"$env_mod1\\\",\\n                \\\"$env_mod4\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"__init__.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"                            os.environ[\\\\\\\"HF_TOKEN\\\\\\\"] = orig_env_token\\\\n\\\",\\n                                    \\\"line_number\\\": 28,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 28\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$env_mod1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"                            os.environ[\\\\\\\"HF_TOKEN\\\\\\\"] = orig_env_token\\\\n\\\",\\n                                    \\\"line_number\\\": 28,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\\\\\"HF_TOKEN\\\\\\\"] =\\\",\\n                                    \\\"matched_length\\\": 24,\\n                                    \\\"offset\\\": 28\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$env_mod4\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"                    orig_env_token = os.environ.pop(\\\\\\\"HF_TOKEN\\\\\\\", None)\\\\n\\\",\\n                                    \\\"line_number\\\": 21,\\n                                    \\\"matched_data\\\": \\\"os.environ.pop(\\\",\\n                                    \\\"matched_length\\\": 15,\\n                                    \\\"offset\\\": 37\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1574.007 Environment Variable Hijacking\\\",\\n                \\\"category\\\": \\\"Defense Evasion\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1574/007/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"system-modification\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"1090 |     Uses snapshot_download for faster parallel downloads.\\\\n1091 |     \\\\\\\"\\\\\\\"\\\\\\\"\\\\n1092 |     # Must be set BEFORE importing huggingface_hub so hf_xet reads it at import time.\\\\n1093 |     os.environ[\\\\\\\"HF_HUB_ENABLE_HF_XET\\\\\\\"] = \\\\\\\"0\\\\\\\"\\\\n1094 |     os.environ[\\\\\\\"HF_HUB_DISABLE_XET\\\\\\\"] = \\\\\\\"1\\\\\\\"\\\\n1095 | \\\\n1096 |     from huggingface_hub import snapshot_download, hf_hub_download\\\",\\n        \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n        \\\"file_path\\\": \\\"backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_environment_manipulation\\\",\\n        \\\"line_number\\\": 1093,\\n        \\\"line_snippet\\\": \\\"os.environ[\\\\\\\"HF_HUB_ENABLE_HF_XET\\\\\\\"] = \\\\\\\"0\\\\\\\"\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$env_read1\\\",\\n                \\\"$env_read3\\\",\\n                \\\"$env_mod1\\\",\\n                \\\"$proc_env1\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"backup.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"    os.environ[\\\\\\\"HF_HUB_ENABLE_HF_XET\\\\\\\"] = \\\\\\\"0\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 1093,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 4\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"    os.environ[\\\\\\\"HF_HUB_DISABLE_XET\\\\\\\"] = \\\\\\\"1\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 1094,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 4\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read3\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"        token = os.getenv(\\\\\\\"HF_TOKEN\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n\\\",\\n                                    \\\"line_number\\\": 495,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 16\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$env_mod1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"    os.environ[\\\\\\\"HF_HUB_ENABLE_HF_XET\\\\\\\"] = \\\\\\\"0\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 1093,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\\\\\"HF_HUB_ENABLE_HF_XET\\\\\\\"] =\\\",\\n                                    \\\"matched_length\\\": 36,\\n                                    \\\"offset\\\": 4\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"    os.environ[\\\\\\\"HF_HUB_DISABLE_XET\\\\\\\"] = \\\\\\\"1\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 1094,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\\\\\"HF_HUB_DISABLE_XET\\\\\\\"] =\\\",\\n                                    \\\"matched_length\\\": 34,\\n                                    \\\"offset\\\": 4\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$proc_env1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"            process = subprocess.run(\\\\n\\\",\\n                                    \\\"line_number\\\": 654,\\n                                    \\\"matched_data\\\": \\\"subprocess.run(\\\\n                [sys.executable, manager_cli_script, \\\\\\\"save-snapshot\\\\\\\"],\\\\n                capture_output=True,\\\\n                text=True,\\\\n                cwd=comfy_dir,\\\\n                env=\\\",\\n                                    \\\"matched_length\\\": 202,\\n                                    \\\"offset\\\": 22\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1574.007 Environment Variable Hijacking\\\",\\n                \\\"category\\\": \\\"Defense Evasion\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1574/007/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-network-requests\\\",\\n            \\\"system-modification\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"468 |                 \\\\\\\"import json, sys, os, urllib.request, shutil\\\\\\\\n\\\\\\\"\\\\n469 |                 \\\\\\\"use_xet = sys.argv[3] == '1'\\\\\\\\n\\\\\\\"\\\\n470 |                 \\\\\\\"if use_xet:\\\\\\\\n\\\\\\\"\\\\n471 |                 \\\\\\\"    os.environ['HF_HUB_DISABLE_XET'] = '0'\\\\\\\\n\\\\\\\"\\\\n472 |                 \\\\\\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '1'\\\\\\\\n\\\\\\\"\\\\n473 |                 \\\\\\\"else:\\\\\\\\n\\\\\\\"\\\\n474 |                 \\\\\\\"    os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\\\\\n\\\\\\\"\\\",\\n        \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n        \\\"file_path\\\": \\\"downloader.py\\\",\\n        \\\"issue_type\\\": \\\"python_environment_manipulation\\\",\\n        \\\"line_number\\\": 471,\\n        \\\"line_snippet\\\": \\\"\\\\\\\"    os.environ['HF_HUB_DISABLE_XET'] = '0'\\\\\\\\n\\\\\\\"\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$env_read1\\\",\\n                \\\"$env_read3\\\",\\n                \\\"$env_mod1\\\",\\n                \\\"$env_mod4\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"downloader.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_DISABLE_XET'] = '0'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 471,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '1'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 472,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 474,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '0'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 475,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"                os.environ['HF_TOKEN'] = orig_hf_token\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 508,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 33\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"            \\\\\\\"os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 977,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 13\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"            \\\\\\\"os.environ['HF_HUB_ENABLE_HF_XET'] = '0'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 978,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 13\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read3\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"token_override = os.getenv(\\\\\\\"HF_TOKEN\\\\\\\")\\\\n\\\",\\n                                    \\\"line_number\\\": 29,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 17\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"_sha_max_env = os.getenv(\\\\\\\"HF_DOWNLOADER_SHA_MAX_BYTES\\\\\\\", \\\\\\\"0\\\\\\\")\\\\n\\\",\\n                                    \\\"line_number\\\": 30,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 15\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"    value = os.getenv(name)\\\\n\\\",\\n                                    \\\"line_number\\\": 38,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 12\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"        token = os.getenv(\\\\\\\"HF_TOKEN\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n\\\",\\n                                    \\\"line_number\\\": 185,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 16\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$env_mod1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_DISABLE_XET'] = '0'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 471,\\n                                    \\\"matched_data\\\": \\\"os.environ['HF_HUB_DISABLE_XET'] =\\\",\\n                                    \\\"matched_length\\\": 34,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '1'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 472,\\n                                    \\\"matched_data\\\": \\\"os.environ['HF_HUB_ENABLE_HF_XET'] =\\\",\\n                                    \\\"matched_length\\\": 36,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 474,\\n                                    \\\"matched_data\\\": \\\"os.environ['HF_HUB_DISABLE_XET'] =\\\",\\n                                    \\\"matched_length\\\": 34,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '0'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 475,\\n                                    \\\"matched_data\\\": \\\"os.environ['HF_HUB_ENABLE_HF_XET'] =\\\",\\n                                    \\\"matched_length\\\": 36,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"                os.environ['HF_TOKEN'] = orig_hf_token\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 508,\\n                                    \\\"matched_data\\\": \\\"os.environ['HF_TOKEN'] =\\\",\\n                                    \\\"matched_length\\\": 24,\\n                                    \\\"offset\\\": 33\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"            \\\\\\\"os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 977,\\n                                    \\\"matched_data\\\": \\\"os.environ['HF_HUB_DISABLE_XET'] =\\\",\\n                                    \\\"matched_length\\\": 34,\\n                                    \\\"offset\\\": 13\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"            \\\\\\\"os.environ['HF_HUB_ENABLE_HF_XET'] = '0'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 978,\\n                                    \\\"matched_data\\\": \\\"os.environ['HF_HUB_ENABLE_HF_XET'] =\\\",\\n                                    \\\"matched_length\\\": 36,\\n                                    \\\"offset\\\": 13\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$env_mod4\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"        orig_hf_token = os.environ.pop('HF_TOKEN', None)\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 502,\\n                                    \\\"matched_data\\\": \\\"os.environ.pop(\\\",\\n                                    \\\"matched_length\\\": 15,\\n                                    \\\"offset\\\": 41\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1574.007 Environment Variable Hijacking\\\",\\n                \\\"category\\\": \\\"Defense Evasion\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1574/007/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"system-modification\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"44 | _nunchaku_blackwell_cache: bool | None = None\\\\n45 | _node_widget_schema_hints_cache: dict[str, list[dict[str, Any]]] | None = None\\\\n46 | \\\\n47 | HF_SEARCH_MAX_CALLS = int(os.getenv(\\\\\\\"HF_SEARCH_MAX_CALLS\\\\\\\", \\\\\\\"200\\\\\\\"))\\\\n48 | HF_SEARCH_RATE_LIMIT_SECONDS = int(os.getenv(\\\\\\\"HF_SEARCH_RATE_LIMIT_SECONDS\\\\\\\", \\\\\\\"300\\\\\\\"))\\\\n49 | HF_SEARCH_MAX_SECONDS = int(os.getenv(\\\\\\\"HF_SEARCH_MAX_SECONDS\\\\\\\", \\\\\\\"60\\\\\\\"))\\\\n50 | HF_SEARCH_CALL_TIMEOUT = int(os.getenv(\\\\\\\"HF_SEARCH_CALL_TIMEOUT\\\\\\\", \\\\\\\"20\\\\\\\"))\\\",\\n        \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n        \\\"file_path\\\": \\\"model_discovery.py\\\",\\n        \\\"issue_type\\\": \\\"python_environment_manipulation\\\",\\n        \\\"line_number\\\": 47,\\n        \\\"line_snippet\\\": \\\"HF_SEARCH_MAX_CALLS = int(os.getenv(\\\\\\\"HF_SEARCH_MAX_CALLS\\\\\\\", \\\\\\\"200\\\\\\\"))\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$env_read3\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"model_discovery.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read3\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"HF_SEARCH_MAX_CALLS = int(os.getenv(\\\\\\\"HF_SEARCH_MAX_CALLS\\\\\\\", \\\\\\\"200\\\\\\\"))\\\\n\\\",\\n                                    \\\"line_number\\\": 47,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 26\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"HF_SEARCH_RATE_LIMIT_SECONDS = int(os.getenv(\\\\\\\"HF_SEARCH_RATE_LIMIT_SECONDS\\\\\\\", \\\\\\\"300\\\\\\\"))\\\\n\\\",\\n                                    \\\"line_number\\\": 48,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 35\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"HF_SEARCH_MAX_SECONDS = int(os.getenv(\\\\\\\"HF_SEARCH_MAX_SECONDS\\\\\\\", \\\\\\\"60\\\\\\\"))\\\\n\\\",\\n                                    \\\"line_number\\\": 49,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 28\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"HF_SEARCH_CALL_TIMEOUT = int(os.getenv(\\\\\\\"HF_SEARCH_CALL_TIMEOUT\\\\\\\", \\\\\\\"20\\\\\\\"))\\\\n\\\",\\n                                    \\\"line_number\\\": 50,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 29\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"PRIORITY_REPO_SCAN_LIMIT = int(os.getenv(\\\\\\\"HF_PRIORITY_REPO_SCAN_LIMIT\\\\\\\", \\\\\\\"100\\\\\\\"))\\\\n\\\",\\n                                    \\\"line_number\\\": 51,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 31\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"HF_URL_CHECK_TIMEOUT = int(os.getenv(\\\\\\\"HF_URL_CHECK_TIMEOUT\\\\\\\", \\\\\\\"8\\\\\\\"))\\\\n\\\",\\n                                    \\\"line_number\\\": 52,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 27\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1574.007 Environment Variable Hijacking\\\",\\n                \\\"category\\\": \\\"Defense Evasion\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1574/007/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"system-modification\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"256 |         print(\\\\\\\"[restore][error] Cannot specify both --skip-models and --only-models.\\\\\\\")\\\\n257 |         sys.exit(1)\\\\n258 | \\\\n259 |     repo_id = os.environ.get(\\\\\\\"COMFYUI_BACKUP\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n260 |     if not repo_id:\\\\n261 |         print(\\\\\\\"[restore] COMFYUI_BACKUP environment variable is not set. Skipping restore.\\\\\\\")\\\\n262 |         sys.exit(0)\\\",\\n        \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n        \\\"file_path\\\": \\\"restore_backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_environment_manipulation\\\",\\n        \\\"line_number\\\": 259,\\n        \\\"line_snippet\\\": \\\"repo_id = os.environ.get(\\\\\\\"COMFYUI_BACKUP\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$env_read2\\\",\\n                \\\"$proc_env1\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"restore_backup.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read2\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"    repo_id = os.environ.get(\\\\\\\"COMFYUI_BACKUP\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n\\\",\\n                                    \\\"line_number\\\": 259,\\n                                    \\\"matched_data\\\": \\\"os.environ.get(\\\",\\n                                    \\\"matched_length\\\": 15,\\n                                    \\\"offset\\\": 14\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$proc_env1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"                subprocess.run(\\\\n\\\",\\n                                    \\\"line_number\\\": 391,\\n                                    \\\"matched_data\\\": \\\"subprocess.run(\\\\n                    [sys.executable, manager_cli, \\\\\\\"restore-snapshot\\\\\\\", merged_path],\\\\n                    cwd=comfy_dir, check=False, env=\\\",\\n                                    \\\"matched_length\\\": 152,\\n                                    \\\"offset\\\": 16\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1574.007 Environment Variable Hijacking\\\",\\n                \\\"category\\\": \\\"Defense Evasion\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1574/007/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"system-modification\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"2630 |             return repo\\\\n2631 |     except Exception:\\\\n2632 |         pass\\\\n2633 |     return os.getenv(\\\\\\\"COMFYUI_BACKUP\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n2634 | \\\\n2635 | \\\\n2636 | def _parse_size_limit(value, default=5.0) -\\\\u003e float:\\\",\\n        \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n        \\\"file_path\\\": \\\"web_api.py\\\",\\n        \\\"issue_type\\\": \\\"python_environment_manipulation\\\",\\n        \\\"line_number\\\": 2633,\\n        \\\"line_snippet\\\": \\\"return os.getenv(\\\\\\\"COMFYUI_BACKUP\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$env_read3\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"web_api.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read3\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"    return os.getenv(\\\\\\\"COMFYUI_BACKUP\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n\\\",\\n                                    \\\"line_number\\\": 2633,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 11\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"        runpod_id = os.getenv(\\\\\\\"RUNPOD_POD_ID\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n\\\",\\n                                    \\\"line_number\\\": 2662,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 20\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"        comfyui_backup_env = os.getenv(\\\\\\\"COMFYUI_BACKUP\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n\\\",\\n                                    \\\"line_number\\\": 2664,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 29\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1574.007 Environment Variable Hijacking\\\",\\n                \\\"category\\\": \\\"Defense Evasion\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1574/007/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-folder-access\\\",\\n            \\\"credential-access\\\",\\n            \\\"system-modification\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"597 | \\\\n598 | def main() -\\\\u003e int:\\\\n599 |     args = parse_args()\\\\n600 |     token = os.getenv(\\\\\\\"HF_TOKEN\\\\\\\") or os.getenv(\\\\\\\"HUGGINGFACE_TOKEN\\\\\\\")\\\\n601 |     input_path = resolve_cli_path(args.input)\\\\n602 | \\\\n603 |     with input_path.open(\\\\\\\"r\\\\\\\", encoding=\\\\\\\"utf-8\\\\\\\") as f:\\\",\\n        \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n        \\\"file_path\\\": \\\"scripts/scrape_priority_repos_to_popular_models.py\\\",\\n        \\\"issue_type\\\": \\\"python_environment_manipulation\\\",\\n        \\\"line_number\\\": 600,\\n        \\\"line_snippet\\\": \\\"token = os.getenv(\\\\\\\"HF_TOKEN\\\\\\\") or os.getenv(\\\\\\\"HUGGINGFACE_TOKEN\\\\\\\")\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$env_read3\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"scripts/scrape_priority_repos_to_popular_models.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read3\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"    token = os.getenv(\\\\\\\"HF_TOKEN\\\\\\\") or os.getenv(\\\\\\\"HUGGINGFACE_TOKEN\\\\\\\")\\\\n\\\",\\n                                    \\\"line_number\\\": 600,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 12\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"    token = os.getenv(\\\\\\\"HF_TOKEN\\\\\\\") or os.getenv(\\\\\\\"HUGGINGFACE_TOKEN\\\\\\\")\\\\n\\\",\\n                                    \\\"line_number\\\": 600,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 37\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1574.007 Environment Variable Hijacking\\\",\\n                \\\"category\\\": \\\"Defense Evasion\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1574/007/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"651 |             env = os.environ.copy()\\\\n652 |             env[\\\\\\\"COMFYUI_PATH\\\\\\\"] = comfy_dir\\\\n653 | \\\\n654 |             process = subprocess.run(\\\\n655 |                 [sys.executable, manager_cli_script, \\\\\\\"save-snapshot\\\\\\\"],\\\\n656 |                 capture_output=True,\\\\n657 |                 text=True,\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 654,\\n        \\\"line_snippet\\\": \\\"process = subprocess.run(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_run_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"797 |                         continue\\\\n798 | \\\\n799 |                     print(f\\\\\\\"[INFO] Cloning: {repo_url}\\\\\\\")\\\\n800 |                     clone_result = subprocess.run(\\\\n801 |                         [\\\\\\\"git\\\\\\\", \\\\\\\"clone\\\\\\\", repo_url],\\\\n802 |                         capture_output=True,\\\\n803 |                         text=True,\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 800,\\n        \\\"line_snippet\\\": \\\"clone_result = subprocess.run(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_run_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"826 |                 try:\\\\n827 |                     print(f\\\\\\\"[INFO] Installing CNR node: {node_name}\\\\\\\")\\\\n828 |                     # Answer N to tracking prompt for each node installation\\\\n829 |                     process = subprocess.Popen(\\\\n830 |                         [\\\\\\\"comfy\\\\\\\", \\\\\\\"node\\\\\\\", \\\\\\\"install\\\\\\\", node_name],\\\\n831 |                         stdin=subprocess.PIPE,\\\\n832 |                         stdout=subprocess.PIPE,\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 829,\\n        \\\"line_snippet\\\": \\\"process = subprocess.Popen(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_popen_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\",\\n            \\\"any-folder-access\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"558 |                     with open(payload_path, \\\\\\\"w\\\\\\\", encoding=\\\\\\\"utf-8\\\\\\\") as f:\\\\n559 |                         json.dump(download_kwargs, f)\\\\n560 | \\\\n561 |                     proc = subprocess.Popen(\\\\n562 |                         [sys.executable, \\\\\\\"-u\\\\\\\", \\\\\\\"-c\\\\\\\", script, payload_path, result_path, xet_flag],\\\\n563 |                         stdout=subprocess.PIPE,\\\\n564 |                         stderr=subprocess.STDOUT,\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"downloader.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 561,\\n        \\\"line_snippet\\\": \\\"proc = subprocess.Popen(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_popen_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\",\\n            \\\"any-folder-access\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"1007 |             with open(payload_path, \\\\\\\"w\\\\\\\", encoding=\\\\\\\"utf-8\\\\\\\") as f:\\\\n1008 |                 json.dump(download_kwargs, f)\\\\n1009 | \\\\n1010 |             proc = subprocess.Popen(\\\\n1011 |                 [sys.executable, \\\\\\\"-u\\\\\\\", \\\\\\\"-c\\\\\\\", script, payload_path, result_path],\\\\n1012 |                 stdout=subprocess.PIPE,\\\\n1013 |                 stderr=subprocess.STDOUT,\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"downloader.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 1010,\\n        \\\"line_snippet\\\": \\\"proc = subprocess.Popen(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_popen_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"79 | def _remote_head(repo_url: str) -\\\\u003e str:\\\\n80 |     errors = []\\\\n81 |     for candidate in _candidate_repo_urls(repo_url):\\\\n82 |         proc = subprocess.run(\\\\n83 |             [\\\\\\\"git\\\\\\\", \\\\\\\"ls-remote\\\\\\\", candidate, \\\\\\\"HEAD\\\\\\\"],\\\\n84 |             text=True, capture_output=True, check=False\\\\n85 |         )\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"restore_backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 82,\\n        \\\"line_snippet\\\": \\\"proc = subprocess.run(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_run_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\",\\n            \\\"any-folder-access\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"353 |             print(\\\\\\\"[restore] Merging custom nodes snapshot...\\\\\\\")\\\\n354 |             current_snapshot_path = os.path.join(tmp_dir, \\\\\\\"current_snapshot.yaml\\\\\\\")\\\\n355 |             # Save current snapshot\\\\n356 |             subprocess.run(\\\\n357 |                 [sys.executable, manager_cli, \\\\\\\"save-snapshot\\\\\\\", \\\\\\\"--output\\\\\\\", current_snapshot_path],\\\\n358 |                 cwd=comfy_dir, check=False, stdout=subprocess.DEVNULL\\\\n359 |             )\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"restore_backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 356,\\n        \\\"line_snippet\\\": \\\"subprocess.run(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_run_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"388 |                 print(\\\\\\\"[restore] Calling cm-cli.py restore-snapshot...\\\\\\\")\\\\n389 |                 env = os.environ.copy()\\\\n390 |                 env[\\\\\\\"PIP_NO_COMPILE\\\\\\\"] = \\\\\\\"1\\\\\\\"\\\\n391 |                 subprocess.run(\\\\n392 |                     [sys.executable, manager_cli, \\\\\\\"restore-snapshot\\\\\\\", merged_path],\\\\n393 |                     cwd=comfy_dir, check=False, env=env\\\\n394 |                 )\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"restore_backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 391,\\n        \\\"line_snippet\\\": \\\"subprocess.run(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_run_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [],\\n        \\\"code_snippet\\\": \\\"797 |                         continue\\\\n798 | \\\\n799 |                     print(f\\\\\\\"[INFO] Cloning: {repo_url}\\\\\\\")\\\\n800 |                     clone_result = subprocess.run(\\\\n801 |                         [\\\\\\\"git\\\\\\\", \\\\\\\"clone\\\\\\\", repo_url],\\\\n802 |                         capture_output=True,\\\\n803 |                         text=True,\\\",\\n        \\\"description\\\": \\\"Detects execution of git clone, git pull, and git fetch commands from Python code, indicating potential supply chain compromise\\\",\\n        \\\"file_path\\\": \\\"backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_git_clone_execution\\\",\\n        \\\"line_number\\\": 800,\\n        \\\"line_snippet\\\": \\\"clone_result = subprocess.run(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$clone_subprocess_list_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1195/001/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools\\\",\\n                \\\"category\\\": \\\"Supply Chain\\\",\\n                \\\"confidence_note\\\": \\\"Patterns ending with _direct have high confidence (95%), including both immediate execution calls and high-confidence execution-prep patterns (e.g., clone list assignment) where the semantic risk is equivalent. Patterns ending with _autoupdate have medium confidence (75%) due to some legitimate auto-update uses. Confidence tiers reflect semantic risk level (clone=high, pull/fetch=medium), not code form.\\\",\\n                \\\"date\\\": \\\"2025-02-16\\\",\\n                \\\"description\\\": \\\"Detects execution of git clone, git pull, and git fetch commands from Python code, indicating potential supply chain compromise\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1195/001/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"Pattern IDs: GCE-001..GCE-015. See docs/PATTERN_TRACEABILITY.md\\\",\\n                \\\"version\\\": \\\"1.2\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_git_clone_execution\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-network-requests\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"751 |                 status_cb(\\\\\\\"downloading\\\\\\\")\\\\n752 | \\\\n753 |             request = urllib.request.Request(raw_url, headers=request_headers, method=\\\\\\\"GET\\\\\\\")\\\\n754 |             with urllib.request.urlopen(request, timeout=60) as response:\\\\n755 |                 final_url = str(getattr(response, \\\\\\\"geturl\\\\\\\", lambda: raw_url)() or raw_url)\\\\n756 |                 headers = getattr(response, \\\\\\\"headers\\\\\\\", {})\\\\n757 |                 content_disposition = \\\\\\\"\\\\\\\"\\\",\\n        \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n        \\\"file_path\\\": \\\"downloader.py\\\",\\n        \\\"issue_type\\\": \\\"python_network_operations\\\",\\n        \\\"line_number\\\": 754,\\n        \\\"line_snippet\\\": \\\"with urllib.request.urlopen(request, timeout=60) as response:\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$http2\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"downloader.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$http2\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"            with urllib.request.urlopen(request, timeout=60) as response:\\\\n\\\",\\n                                    \\\"line_number\\\": 754,\\n                                    \\\"matched_data\\\": \\\"urllib.request.urlopen(\\\",\\n                                    \\\"matched_length\\\": 23,\\n                                    \\\"offset\\\": 17\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1041 Exfiltration Over C2 Channel\\\",\\n                \\\"attack_id2\\\": \\\"T1048 Exfiltration Over Alternative Protocol\\\",\\n                \\\"category\\\": \\\"Exfiltration\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1041/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-network-requests\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"360 |         if extra_headers:\\\\n361 |             req_headers.update(extra_headers)\\\\n362 |         req = urllib.request.Request(url, method=method, headers=req_headers)\\\\n363 |         with urllib.request.urlopen(req, timeout=HF_URL_CHECK_TIMEOUT) as resp:\\\\n364 |             code = getattr(resp, \\\\\\\"status\\\\\\\", None) or resp.getcode()\\\\n365 |             return 200 \\\\u003c= int(code) \\\\u003c 400\\\\n366 | \\\",\\n        \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n        \\\"file_path\\\": \\\"model_discovery.py\\\",\\n        \\\"issue_type\\\": \\\"python_network_operations\\\",\\n        \\\"line_number\\\": 363,\\n        \\\"line_snippet\\\": \\\"with urllib.request.urlopen(req, timeout=HF_URL_CHECK_TIMEOUT) as resp:\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$http2\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"model_discovery.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$http2\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"        with urllib.request.urlopen(req, timeout=HF_URL_CHECK_TIMEOUT) as resp:\\\\n\\\",\\n                                    \\\"line_number\\\": 363,\\n                                    \\\"matched_data\\\": \\\"urllib.request.urlopen(\\\",\\n                                    \\\"matched_length\\\": 23,\\n                                    \\\"offset\\\": 13\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1041 Exfiltration Over C2 Channel\\\",\\n                \\\"attack_id2\\\": \\\"T1048 Exfiltration Over Alternative Protocol\\\",\\n                \\\"category\\\": \\\"Exfiltration\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1041/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-network-requests\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"2 | import urllib.request\\\\n3 | try:\\\\n4 |     req = urllib.request.Request(\\\\\\\"https://huggingface.co/api/models/black-forest-labs/FLUX.1-dev\\\\\\\")\\\\n5 |     resp = urllib.request.urlopen(req)\\\\n6 | except Exception as e:\\\\n7 |     print(type(e), e)\\\",\\n        \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n        \\\"file_path\\\": \\\"test_hf.py\\\",\\n        \\\"issue_type\\\": \\\"python_network_operations\\\",\\n        \\\"line_number\\\": 5,\\n        \\\"line_snippet\\\": \\\"resp = urllib.request.urlopen(req)\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$http2\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"test_hf.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$http2\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"    resp = urllib.request.urlopen(req)\\\\n\\\",\\n                                    \\\"line_number\\\": 5,\\n                                    \\\"matched_data\\\": \\\"urllib.request.urlopen(\\\",\\n                                    \\\"matched_length\\\": 23,\\n                                    \\\"offset\\\": 11\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1041 Exfiltration Over C2 Channel\\\",\\n                \\\"attack_id2\\\": \\\"T1048 Exfiltration Over Alternative Protocol\\\",\\n                \\\"category\\\": \\\"Exfiltration\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1041/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-network-requests\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"6820 |             }\\\\n6821 | \\\\n6822 |             const originalLoadGraphData = comfyApp.loadGraphData.bind(comfyApp);\\\\n6823 |             comfyApp.loadGraphData = async (...args) =\\\\u003e {\\\\n6824 |                 const loadedGraphData = normalizeWorkflowOpenGraphDataArg(args?.[0]);\\\\n6825 |                 workflowOpenLastTriggeredAt = 0;\\\\n6826 |                 workflowOpenLastHandledSignature = \\\\\\\"\\\\\\\";\\\",\\n        \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n        \\\"file_path\\\": \\\"js/auto_download.js\\\",\\n        \\\"issue_type\\\": \\\"python_network_operations\\\",\\n        \\\"line_number\\\": 6823,\\n        \\\"line_snippet\\\": \\\"comfyApp.loadGraphData = async (...args) =\\\\u003e {\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$socket4\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"js/auto_download.js\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$socket4\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"            comfyApp.loadGraphData = async (...args) =\\\\u003e {\\\\n\\\",\\n                                    \\\"line_number\\\": 6823,\\n                                    \\\"matched_data\\\": \\\".bind(\\\",\\n                                    \\\"matched_length\\\": 6,\\n                                    \\\"offset\\\": 2\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                executionErrorStore.surfaceMissingModels.bind(executionErrorStore);\\\\n\\\",\\n                                    \\\"line_number\\\": 6941,\\n                                    \\\"matched_data\\\": \\\".bind(\\\",\\n                                    \\\"matched_length\\\": 6,\\n                                    \\\"offset\\\": 75\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1041 Exfiltration Over C2 Channel\\\",\\n                \\\"attack_id2\\\": \\\"T1048 Exfiltration Over Alternative Protocol\\\",\\n                \\\"category\\\": \\\"Exfiltration\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1041/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-network-requests\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"150 |     for attempt in range(1, retries + 1):\\\\n151 |         req = urllib.request.Request(url, headers=headers)\\\\n152 |         try:\\\\n153 |             with urllib.request.urlopen(req, timeout=timeout) as resp:\\\\n154 |                 payload = resp.read()\\\\n155 |                 data = json.loads(payload.decode(\\\\\\\"utf-8\\\\\\\"))\\\\n156 |                 response_headers = {k.lower(): v for k, v in resp.headers.items()}\\\",\\n        \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n        \\\"file_path\\\": \\\"scripts/scrape_priority_repos_to_popular_models.py\\\",\\n        \\\"issue_type\\\": \\\"python_network_operations\\\",\\n        \\\"line_number\\\": 153,\\n        \\\"line_snippet\\\": \\\"with urllib.request.urlopen(req, timeout=timeout) as resp:\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$http2\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"scripts/scrape_priority_repos_to_popular_models.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$http2\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"            with urllib.request.urlopen(req, timeout=timeout) as resp:\\\\n\\\",\\n                                    \\\"line_number\\\": 153,\\n                                    \\\"matched_data\\\": \\\"urllib.request.urlopen(\\\",\\n                                    \\\"matched_length\\\": 23,\\n                                    \\\"offset\\\": 17\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1041 Exfiltration Over C2 Channel\\\",\\n                \\\"attack_id2\\\": \\\"T1048 Exfiltration Over Alternative Protocol\\\",\\n                \\\"category\\\": \\\"Exfiltration\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1041/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [],\\n        \\\"code_snippet\\\": \\\"{\\\\n  \\\\\\\"name\\\\\\\": \\\\\\\"ComfyUI_HuggingFace_Downloader\\\\\\\",\\\\n  \\\\\\\"lockfileVersion\\\\\\\": 3,\\\\n  \\\\\\\"requires\\\\\\\": true,\\\\n  \\\\\\\"packages\\\\\\\": {\\\\n\\\",\\n        \\\"description\\\": \\\"Vendored file identified and hash verified against upstream registry\\\",\\n        \\\"file_path\\\": \\\"package-lock.json\\\",\\n        \\\"issue_type\\\": \\\"vendored_known\\\",\\n        \\\"line_number\\\": 1,\\n        \\\"line_snippet\\\": \\\"{\\\",\\n        \\\"metadata\\\": {\\n            \\\"detection_reason\\\": \\\"npm lockfile (39 entries)\\\",\\n            \\\"ecosystem\\\": \\\"npm\\\",\\n            \\\"hash_verified\\\": true,\\n            \\\"lockfile_not_found\\\": 0,\\n            \\\"lockfile_registry_unavailable\\\": 0,\\n            \\\"lockfile_skipped_over_limit\\\": 0,\\n            \\\"lockfile_skipped_registry_down\\\": 0,\\n            \\\"lockfile_total_entries\\\": 39,\\n            \\\"lockfile_verified_match\\\": 39,\\n            \\\"lockfile_verified_mismatch\\\": 0\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"provenance_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    }\\n]\", \"by\": \"admin@comfy.org\"}]}","supported_accelerators":[],"supported_comfyui_frontend_version":"","supported_comfyui_version":"","supported_os":[],"tags":[],"tags_admin":[],"version":"1.34.19"},{"changelog":"","comfy_node_extract_status":"pending","createdAt":"2026-09-02T14:04:30.455036Z","dependencies":["huggingface_hub\u003e=0.20.0"],"deprecated":false,"downloadUrl":"https://cdn.comfy.org/jnx/ComfyUI_HuggingFace_Downloader/1.34.18/node.zip","id":"880089a9-63b3-41c0-89b0-591863264013","node_id":"ComfyUI_HuggingFace_Downloader","status":"NodeVersionStatusBanned","status_reason":"{\"message\": \"policy-v0.3: path traversal / unconfined file side-effect (unauthenticated, CSRF-reachable) \\u2014 install_models (web_api.py:2584) and queue_download (web_api.py:3083/3127) read a free-STRING 'folder' from the unauthenticated JSON body and pass it to file_manager.resolve_target_dir(final_folder). resolve_target_dir returns an ABSOLUTE folder verbatim (file_manager.py:160-161) and for relative input does os.path.join(models_dir, final_folder) with no\\u2026 (downloader.py:417) [Rule 11]\", \"by\": \"drltdata@comfy.org\", \"statusHistory\": [{\"status\": \"NodeVersionStatusFlagged\", \"message\": \"[\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"credential-access\\\",\\n            \\\"system-modification\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"25 |                         pass\\\\n26 |                     finally:\\\\n27 |                         if orig_env_token is not None:\\\\n28 |                             os.environ[\\\\\\\"HF_TOKEN\\\\\\\"] = orig_env_token\\\\n29 |             raise e\\\\n30 | \\\\n31 |     huggingface_hub.file_download.hf_hub_download = _patched_hf_hub_download\\\",\\n        \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n        \\\"file_path\\\": \\\"__init__.py\\\",\\n        \\\"issue_type\\\": \\\"python_environment_manipulation\\\",\\n        \\\"line_number\\\": 28,\\n        \\\"line_snippet\\\": \\\"os.environ[\\\\\\\"HF_TOKEN\\\\\\\"] = orig_env_token\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$env_read1\\\",\\n                \\\"$env_mod1\\\",\\n                \\\"$env_mod4\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"__init__.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"                            os.environ[\\\\\\\"HF_TOKEN\\\\\\\"] = orig_env_token\\\\n\\\",\\n                                    \\\"line_number\\\": 28,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 28\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$env_mod1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"                            os.environ[\\\\\\\"HF_TOKEN\\\\\\\"] = orig_env_token\\\\n\\\",\\n                                    \\\"line_number\\\": 28,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\\\\\"HF_TOKEN\\\\\\\"] =\\\",\\n                                    \\\"matched_length\\\": 24,\\n                                    \\\"offset\\\": 28\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$env_mod4\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"                    orig_env_token = os.environ.pop(\\\\\\\"HF_TOKEN\\\\\\\", None)\\\\n\\\",\\n                                    \\\"line_number\\\": 21,\\n                                    \\\"matched_data\\\": \\\"os.environ.pop(\\\",\\n                                    \\\"matched_length\\\": 15,\\n                                    \\\"offset\\\": 37\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1574.007 Environment Variable Hijacking\\\",\\n                \\\"category\\\": \\\"Defense Evasion\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1574/007/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"system-modification\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"1090 |     Uses snapshot_download for faster parallel downloads.\\\\n1091 |     \\\\\\\"\\\\\\\"\\\\\\\"\\\\n1092 |     # Must be set BEFORE importing huggingface_hub so hf_xet reads it at import time.\\\\n1093 |     os.environ[\\\\\\\"HF_HUB_ENABLE_HF_XET\\\\\\\"] = \\\\\\\"0\\\\\\\"\\\\n1094 |     os.environ[\\\\\\\"HF_HUB_DISABLE_XET\\\\\\\"] = \\\\\\\"1\\\\\\\"\\\\n1095 | \\\\n1096 |     from huggingface_hub import snapshot_download, hf_hub_download\\\",\\n        \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n        \\\"file_path\\\": \\\"backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_environment_manipulation\\\",\\n        \\\"line_number\\\": 1093,\\n        \\\"line_snippet\\\": \\\"os.environ[\\\\\\\"HF_HUB_ENABLE_HF_XET\\\\\\\"] = \\\\\\\"0\\\\\\\"\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$env_read1\\\",\\n                \\\"$env_read3\\\",\\n                \\\"$env_mod1\\\",\\n                \\\"$proc_env1\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"backup.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"    os.environ[\\\\\\\"HF_HUB_ENABLE_HF_XET\\\\\\\"] = \\\\\\\"0\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 1093,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 4\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"    os.environ[\\\\\\\"HF_HUB_DISABLE_XET\\\\\\\"] = \\\\\\\"1\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 1094,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 4\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read3\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"        token = os.getenv(\\\\\\\"HF_TOKEN\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n\\\",\\n                                    \\\"line_number\\\": 495,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 16\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$env_mod1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"    os.environ[\\\\\\\"HF_HUB_ENABLE_HF_XET\\\\\\\"] = \\\\\\\"0\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 1093,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\\\\\"HF_HUB_ENABLE_HF_XET\\\\\\\"] =\\\",\\n                                    \\\"matched_length\\\": 36,\\n                                    \\\"offset\\\": 4\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"    os.environ[\\\\\\\"HF_HUB_DISABLE_XET\\\\\\\"] = \\\\\\\"1\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 1094,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\\\\\"HF_HUB_DISABLE_XET\\\\\\\"] =\\\",\\n                                    \\\"matched_length\\\": 34,\\n                                    \\\"offset\\\": 4\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$proc_env1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"            process = subprocess.run(\\\\n\\\",\\n                                    \\\"line_number\\\": 654,\\n                                    \\\"matched_data\\\": \\\"subprocess.run(\\\\n                [sys.executable, manager_cli_script, \\\\\\\"save-snapshot\\\\\\\"],\\\\n                capture_output=True,\\\\n                text=True,\\\\n                cwd=comfy_dir,\\\\n                env=\\\",\\n                                    \\\"matched_length\\\": 202,\\n                                    \\\"offset\\\": 22\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1574.007 Environment Variable Hijacking\\\",\\n                \\\"category\\\": \\\"Defense Evasion\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1574/007/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-network-requests\\\",\\n            \\\"system-modification\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"468 |                 \\\\\\\"import json, sys, os, urllib.request, shutil\\\\\\\\n\\\\\\\"\\\\n469 |                 \\\\\\\"use_xet = sys.argv[3] == '1'\\\\\\\\n\\\\\\\"\\\\n470 |                 \\\\\\\"if use_xet:\\\\\\\\n\\\\\\\"\\\\n471 |                 \\\\\\\"    os.environ['HF_HUB_DISABLE_XET'] = '0'\\\\\\\\n\\\\\\\"\\\\n472 |                 \\\\\\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '1'\\\\\\\\n\\\\\\\"\\\\n473 |                 \\\\\\\"else:\\\\\\\\n\\\\\\\"\\\\n474 |                 \\\\\\\"    os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\\\\\n\\\\\\\"\\\",\\n        \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n        \\\"file_path\\\": \\\"downloader.py\\\",\\n        \\\"issue_type\\\": \\\"python_environment_manipulation\\\",\\n        \\\"line_number\\\": 471,\\n        \\\"line_snippet\\\": \\\"\\\\\\\"    os.environ['HF_HUB_DISABLE_XET'] = '0'\\\\\\\\n\\\\\\\"\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$env_read1\\\",\\n                \\\"$env_read3\\\",\\n                \\\"$env_mod1\\\",\\n                \\\"$env_mod4\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"downloader.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_DISABLE_XET'] = '0'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 471,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '1'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 472,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 474,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '0'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 475,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"                os.environ['HF_TOKEN'] = orig_hf_token\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 508,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 33\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"            \\\\\\\"os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 977,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 13\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"            \\\\\\\"os.environ['HF_HUB_ENABLE_HF_XET'] = '0'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 978,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 13\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read3\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"token_override = os.getenv(\\\\\\\"HF_TOKEN\\\\\\\")\\\\n\\\",\\n                                    \\\"line_number\\\": 29,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 17\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"_sha_max_env = os.getenv(\\\\\\\"HF_DOWNLOADER_SHA_MAX_BYTES\\\\\\\", \\\\\\\"0\\\\\\\")\\\\n\\\",\\n                                    \\\"line_number\\\": 30,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 15\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"    value = os.getenv(name)\\\\n\\\",\\n                                    \\\"line_number\\\": 38,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 12\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"        token = os.getenv(\\\\\\\"HF_TOKEN\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n\\\",\\n                                    \\\"line_number\\\": 185,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 16\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$env_mod1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_DISABLE_XET'] = '0'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 471,\\n                                    \\\"matched_data\\\": \\\"os.environ['HF_HUB_DISABLE_XET'] =\\\",\\n                                    \\\"matched_length\\\": 34,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '1'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 472,\\n                                    \\\"matched_data\\\": \\\"os.environ['HF_HUB_ENABLE_HF_XET'] =\\\",\\n                                    \\\"matched_length\\\": 36,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 474,\\n                                    \\\"matched_data\\\": \\\"os.environ['HF_HUB_DISABLE_XET'] =\\\",\\n                                    \\\"matched_length\\\": 34,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '0'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 475,\\n                                    \\\"matched_data\\\": \\\"os.environ['HF_HUB_ENABLE_HF_XET'] =\\\",\\n                                    \\\"matched_length\\\": 36,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"                os.environ['HF_TOKEN'] = orig_hf_token\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 508,\\n                                    \\\"matched_data\\\": \\\"os.environ['HF_TOKEN'] =\\\",\\n                                    \\\"matched_length\\\": 24,\\n                                    \\\"offset\\\": 33\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"            \\\\\\\"os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 977,\\n                                    \\\"matched_data\\\": \\\"os.environ['HF_HUB_DISABLE_XET'] =\\\",\\n                                    \\\"matched_length\\\": 34,\\n                                    \\\"offset\\\": 13\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"            \\\\\\\"os.environ['HF_HUB_ENABLE_HF_XET'] = '0'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 978,\\n                                    \\\"matched_data\\\": \\\"os.environ['HF_HUB_ENABLE_HF_XET'] =\\\",\\n                                    \\\"matched_length\\\": 36,\\n                                    \\\"offset\\\": 13\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$env_mod4\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"        orig_hf_token = os.environ.pop('HF_TOKEN', None)\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 502,\\n                                    \\\"matched_data\\\": \\\"os.environ.pop(\\\",\\n                                    \\\"matched_length\\\": 15,\\n                                    \\\"offset\\\": 41\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1574.007 Environment Variable Hijacking\\\",\\n                \\\"category\\\": \\\"Defense Evasion\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1574/007/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"system-modification\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"44 | _nunchaku_blackwell_cache: bool | None = None\\\\n45 | _node_widget_schema_hints_cache: dict[str, list[dict[str, Any]]] | None = None\\\\n46 | \\\\n47 | HF_SEARCH_MAX_CALLS = int(os.getenv(\\\\\\\"HF_SEARCH_MAX_CALLS\\\\\\\", \\\\\\\"200\\\\\\\"))\\\\n48 | HF_SEARCH_RATE_LIMIT_SECONDS = int(os.getenv(\\\\\\\"HF_SEARCH_RATE_LIMIT_SECONDS\\\\\\\", \\\\\\\"300\\\\\\\"))\\\\n49 | HF_SEARCH_MAX_SECONDS = int(os.getenv(\\\\\\\"HF_SEARCH_MAX_SECONDS\\\\\\\", \\\\\\\"60\\\\\\\"))\\\\n50 | HF_SEARCH_CALL_TIMEOUT = int(os.getenv(\\\\\\\"HF_SEARCH_CALL_TIMEOUT\\\\\\\", \\\\\\\"20\\\\\\\"))\\\",\\n        \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n        \\\"file_path\\\": \\\"model_discovery.py\\\",\\n        \\\"issue_type\\\": \\\"python_environment_manipulation\\\",\\n        \\\"line_number\\\": 47,\\n        \\\"line_snippet\\\": \\\"HF_SEARCH_MAX_CALLS = int(os.getenv(\\\\\\\"HF_SEARCH_MAX_CALLS\\\\\\\", \\\\\\\"200\\\\\\\"))\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$env_read3\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"model_discovery.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read3\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"HF_SEARCH_MAX_CALLS = int(os.getenv(\\\\\\\"HF_SEARCH_MAX_CALLS\\\\\\\", \\\\\\\"200\\\\\\\"))\\\\n\\\",\\n                                    \\\"line_number\\\": 47,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 26\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"HF_SEARCH_RATE_LIMIT_SECONDS = int(os.getenv(\\\\\\\"HF_SEARCH_RATE_LIMIT_SECONDS\\\\\\\", \\\\\\\"300\\\\\\\"))\\\\n\\\",\\n                                    \\\"line_number\\\": 48,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 35\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"HF_SEARCH_MAX_SECONDS = int(os.getenv(\\\\\\\"HF_SEARCH_MAX_SECONDS\\\\\\\", \\\\\\\"60\\\\\\\"))\\\\n\\\",\\n                                    \\\"line_number\\\": 49,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 28\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"HF_SEARCH_CALL_TIMEOUT = int(os.getenv(\\\\\\\"HF_SEARCH_CALL_TIMEOUT\\\\\\\", \\\\\\\"20\\\\\\\"))\\\\n\\\",\\n                                    \\\"line_number\\\": 50,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 29\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"PRIORITY_REPO_SCAN_LIMIT = int(os.getenv(\\\\\\\"HF_PRIORITY_REPO_SCAN_LIMIT\\\\\\\", \\\\\\\"100\\\\\\\"))\\\\n\\\",\\n                                    \\\"line_number\\\": 51,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 31\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"HF_URL_CHECK_TIMEOUT = int(os.getenv(\\\\\\\"HF_URL_CHECK_TIMEOUT\\\\\\\", \\\\\\\"8\\\\\\\"))\\\\n\\\",\\n                                    \\\"line_number\\\": 52,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 27\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1574.007 Environment Variable Hijacking\\\",\\n                \\\"category\\\": \\\"Defense Evasion\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1574/007/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"system-modification\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"256 |         print(\\\\\\\"[restore][error] Cannot specify both --skip-models and --only-models.\\\\\\\")\\\\n257 |         sys.exit(1)\\\\n258 | \\\\n259 |     repo_id = os.environ.get(\\\\\\\"COMFYUI_BACKUP\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n260 |     if not repo_id:\\\\n261 |         print(\\\\\\\"[restore] COMFYUI_BACKUP environment variable is not set. Skipping restore.\\\\\\\")\\\\n262 |         sys.exit(0)\\\",\\n        \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n        \\\"file_path\\\": \\\"restore_backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_environment_manipulation\\\",\\n        \\\"line_number\\\": 259,\\n        \\\"line_snippet\\\": \\\"repo_id = os.environ.get(\\\\\\\"COMFYUI_BACKUP\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$env_read2\\\",\\n                \\\"$proc_env1\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"restore_backup.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read2\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"    repo_id = os.environ.get(\\\\\\\"COMFYUI_BACKUP\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n\\\",\\n                                    \\\"line_number\\\": 259,\\n                                    \\\"matched_data\\\": \\\"os.environ.get(\\\",\\n                                    \\\"matched_length\\\": 15,\\n                                    \\\"offset\\\": 14\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$proc_env1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"                subprocess.run(\\\\n\\\",\\n                                    \\\"line_number\\\": 391,\\n                                    \\\"matched_data\\\": \\\"subprocess.run(\\\\n                    [sys.executable, manager_cli, \\\\\\\"restore-snapshot\\\\\\\", merged_path],\\\\n                    cwd=comfy_dir, check=False, env=\\\",\\n                                    \\\"matched_length\\\": 152,\\n                                    \\\"offset\\\": 16\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1574.007 Environment Variable Hijacking\\\",\\n                \\\"category\\\": \\\"Defense Evasion\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1574/007/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"system-modification\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"2630 |             return repo\\\\n2631 |     except Exception:\\\\n2632 |         pass\\\\n2633 |     return os.getenv(\\\\\\\"COMFYUI_BACKUP\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n2634 | \\\\n2635 | \\\\n2636 | def _parse_size_limit(value, default=5.0) -\\\\u003e float:\\\",\\n        \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n        \\\"file_path\\\": \\\"web_api.py\\\",\\n        \\\"issue_type\\\": \\\"python_environment_manipulation\\\",\\n        \\\"line_number\\\": 2633,\\n        \\\"line_snippet\\\": \\\"return os.getenv(\\\\\\\"COMFYUI_BACKUP\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$env_read3\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"web_api.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read3\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"    return os.getenv(\\\\\\\"COMFYUI_BACKUP\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n\\\",\\n                                    \\\"line_number\\\": 2633,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 11\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"        runpod_id = os.getenv(\\\\\\\"RUNPOD_POD_ID\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n\\\",\\n                                    \\\"line_number\\\": 2662,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 20\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"        comfyui_backup_env = os.getenv(\\\\\\\"COMFYUI_BACKUP\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n\\\",\\n                                    \\\"line_number\\\": 2664,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 29\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1574.007 Environment Variable Hijacking\\\",\\n                \\\"category\\\": \\\"Defense Evasion\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1574/007/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-folder-access\\\",\\n            \\\"credential-access\\\",\\n            \\\"system-modification\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"597 | \\\\n598 | def main() -\\\\u003e int:\\\\n599 |     args = parse_args()\\\\n600 |     token = os.getenv(\\\\\\\"HF_TOKEN\\\\\\\") or os.getenv(\\\\\\\"HUGGINGFACE_TOKEN\\\\\\\")\\\\n601 |     input_path = resolve_cli_path(args.input)\\\\n602 | \\\\n603 |     with input_path.open(\\\\\\\"r\\\\\\\", encoding=\\\\\\\"utf-8\\\\\\\") as f:\\\",\\n        \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n        \\\"file_path\\\": \\\"scripts/scrape_priority_repos_to_popular_models.py\\\",\\n        \\\"issue_type\\\": \\\"python_environment_manipulation\\\",\\n        \\\"line_number\\\": 600,\\n        \\\"line_snippet\\\": \\\"token = os.getenv(\\\\\\\"HF_TOKEN\\\\\\\") or os.getenv(\\\\\\\"HUGGINGFACE_TOKEN\\\\\\\")\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$env_read3\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"scripts/scrape_priority_repos_to_popular_models.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read3\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"    token = os.getenv(\\\\\\\"HF_TOKEN\\\\\\\") or os.getenv(\\\\\\\"HUGGINGFACE_TOKEN\\\\\\\")\\\\n\\\",\\n                                    \\\"line_number\\\": 600,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 12\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"    token = os.getenv(\\\\\\\"HF_TOKEN\\\\\\\") or os.getenv(\\\\\\\"HUGGINGFACE_TOKEN\\\\\\\")\\\\n\\\",\\n                                    \\\"line_number\\\": 600,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 37\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1574.007 Environment Variable Hijacking\\\",\\n                \\\"category\\\": \\\"Defense Evasion\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1574/007/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"651 |             env = os.environ.copy()\\\\n652 |             env[\\\\\\\"COMFYUI_PATH\\\\\\\"] = comfy_dir\\\\n653 | \\\\n654 |             process = subprocess.run(\\\\n655 |                 [sys.executable, manager_cli_script, \\\\\\\"save-snapshot\\\\\\\"],\\\\n656 |                 capture_output=True,\\\\n657 |                 text=True,\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 654,\\n        \\\"line_snippet\\\": \\\"process = subprocess.run(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_run_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"797 |                         continue\\\\n798 | \\\\n799 |                     print(f\\\\\\\"[INFO] Cloning: {repo_url}\\\\\\\")\\\\n800 |                     clone_result = subprocess.run(\\\\n801 |                         [\\\\\\\"git\\\\\\\", \\\\\\\"clone\\\\\\\", repo_url],\\\\n802 |                         capture_output=True,\\\\n803 |                         text=True,\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 800,\\n        \\\"line_snippet\\\": \\\"clone_result = subprocess.run(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_run_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"826 |                 try:\\\\n827 |                     print(f\\\\\\\"[INFO] Installing CNR node: {node_name}\\\\\\\")\\\\n828 |                     # Answer N to tracking prompt for each node installation\\\\n829 |                     process = subprocess.Popen(\\\\n830 |                         [\\\\\\\"comfy\\\\\\\", \\\\\\\"node\\\\\\\", \\\\\\\"install\\\\\\\", node_name],\\\\n831 |                         stdin=subprocess.PIPE,\\\\n832 |                         stdout=subprocess.PIPE,\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 829,\\n        \\\"line_snippet\\\": \\\"process = subprocess.Popen(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_popen_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\",\\n            \\\"any-folder-access\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"558 |                     with open(payload_path, \\\\\\\"w\\\\\\\", encoding=\\\\\\\"utf-8\\\\\\\") as f:\\\\n559 |                         json.dump(download_kwargs, f)\\\\n560 | \\\\n561 |                     proc = subprocess.Popen(\\\\n562 |                         [sys.executable, \\\\\\\"-u\\\\\\\", \\\\\\\"-c\\\\\\\", script, payload_path, result_path, xet_flag],\\\\n563 |                         stdout=subprocess.PIPE,\\\\n564 |                         stderr=subprocess.STDOUT,\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"downloader.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 561,\\n        \\\"line_snippet\\\": \\\"proc = subprocess.Popen(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_popen_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\",\\n            \\\"any-folder-access\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"1007 |             with open(payload_path, \\\\\\\"w\\\\\\\", encoding=\\\\\\\"utf-8\\\\\\\") as f:\\\\n1008 |                 json.dump(download_kwargs, f)\\\\n1009 | \\\\n1010 |             proc = subprocess.Popen(\\\\n1011 |                 [sys.executable, \\\\\\\"-u\\\\\\\", \\\\\\\"-c\\\\\\\", script, payload_path, result_path],\\\\n1012 |                 stdout=subprocess.PIPE,\\\\n1013 |                 stderr=subprocess.STDOUT,\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"downloader.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 1010,\\n        \\\"line_snippet\\\": \\\"proc = subprocess.Popen(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_popen_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"79 | def _remote_head(repo_url: str) -\\\\u003e str:\\\\n80 |     errors = []\\\\n81 |     for candidate in _candidate_repo_urls(repo_url):\\\\n82 |         proc = subprocess.run(\\\\n83 |             [\\\\\\\"git\\\\\\\", \\\\\\\"ls-remote\\\\\\\", candidate, \\\\\\\"HEAD\\\\\\\"],\\\\n84 |             text=True, capture_output=True, check=False\\\\n85 |         )\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"restore_backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 82,\\n        \\\"line_snippet\\\": \\\"proc = subprocess.run(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_run_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\",\\n            \\\"any-folder-access\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"353 |             print(\\\\\\\"[restore] Merging custom nodes snapshot...\\\\\\\")\\\\n354 |             current_snapshot_path = os.path.join(tmp_dir, \\\\\\\"current_snapshot.yaml\\\\\\\")\\\\n355 |             # Save current snapshot\\\\n356 |             subprocess.run(\\\\n357 |                 [sys.executable, manager_cli, \\\\\\\"save-snapshot\\\\\\\", \\\\\\\"--output\\\\\\\", current_snapshot_path],\\\\n358 |                 cwd=comfy_dir, check=False, stdout=subprocess.DEVNULL\\\\n359 |             )\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"restore_backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 356,\\n        \\\"line_snippet\\\": \\\"subprocess.run(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_run_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"388 |                 print(\\\\\\\"[restore] Calling cm-cli.py restore-snapshot...\\\\\\\")\\\\n389 |                 env = os.environ.copy()\\\\n390 |                 env[\\\\\\\"PIP_NO_COMPILE\\\\\\\"] = \\\\\\\"1\\\\\\\"\\\\n391 |                 subprocess.run(\\\\n392 |                     [sys.executable, manager_cli, \\\\\\\"restore-snapshot\\\\\\\", merged_path],\\\\n393 |                     cwd=comfy_dir, check=False, env=env\\\\n394 |                 )\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"restore_backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 391,\\n        \\\"line_snippet\\\": \\\"subprocess.run(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_run_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [],\\n        \\\"code_snippet\\\": \\\"797 |                         continue\\\\n798 | \\\\n799 |                     print(f\\\\\\\"[INFO] Cloning: {repo_url}\\\\\\\")\\\\n800 |                     clone_result = subprocess.run(\\\\n801 |                         [\\\\\\\"git\\\\\\\", \\\\\\\"clone\\\\\\\", repo_url],\\\\n802 |                         capture_output=True,\\\\n803 |                         text=True,\\\",\\n        \\\"description\\\": \\\"Detects execution of git clone, git pull, and git fetch commands from Python code, indicating potential supply chain compromise\\\",\\n        \\\"file_path\\\": \\\"backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_git_clone_execution\\\",\\n        \\\"line_number\\\": 800,\\n        \\\"line_snippet\\\": \\\"clone_result = subprocess.run(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$clone_subprocess_list_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1195/001/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools\\\",\\n                \\\"category\\\": \\\"Supply Chain\\\",\\n                \\\"confidence_note\\\": \\\"Patterns ending with _direct have high confidence (95%), including both immediate execution calls and high-confidence execution-prep patterns (e.g., clone list assignment) where the semantic risk is equivalent. Patterns ending with _autoupdate have medium confidence (75%) due to some legitimate auto-update uses. Confidence tiers reflect semantic risk level (clone=high, pull/fetch=medium), not code form.\\\",\\n                \\\"date\\\": \\\"2025-02-16\\\",\\n                \\\"description\\\": \\\"Detects execution of git clone, git pull, and git fetch commands from Python code, indicating potential supply chain compromise\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1195/001/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"Pattern IDs: GCE-001..GCE-015. See docs/PATTERN_TRACEABILITY.md\\\",\\n                \\\"version\\\": \\\"1.2\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_git_clone_execution\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-network-requests\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"751 |                 status_cb(\\\\\\\"downloading\\\\\\\")\\\\n752 | \\\\n753 |             request = urllib.request.Request(raw_url, headers=request_headers, method=\\\\\\\"GET\\\\\\\")\\\\n754 |             with urllib.request.urlopen(request, timeout=60) as response:\\\\n755 |                 final_url = str(getattr(response, \\\\\\\"geturl\\\\\\\", lambda: raw_url)() or raw_url)\\\\n756 |                 headers = getattr(response, \\\\\\\"headers\\\\\\\", {})\\\\n757 |                 content_disposition = \\\\\\\"\\\\\\\"\\\",\\n        \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n        \\\"file_path\\\": \\\"downloader.py\\\",\\n        \\\"issue_type\\\": \\\"python_network_operations\\\",\\n        \\\"line_number\\\": 754,\\n        \\\"line_snippet\\\": \\\"with urllib.request.urlopen(request, timeout=60) as response:\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$http2\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"downloader.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$http2\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"            with urllib.request.urlopen(request, timeout=60) as response:\\\\n\\\",\\n                                    \\\"line_number\\\": 754,\\n                                    \\\"matched_data\\\": \\\"urllib.request.urlopen(\\\",\\n                                    \\\"matched_length\\\": 23,\\n                                    \\\"offset\\\": 17\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1041 Exfiltration Over C2 Channel\\\",\\n                \\\"attack_id2\\\": \\\"T1048 Exfiltration Over Alternative Protocol\\\",\\n                \\\"category\\\": \\\"Exfiltration\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1041/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-network-requests\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"360 |         if extra_headers:\\\\n361 |             req_headers.update(extra_headers)\\\\n362 |         req = urllib.request.Request(url, method=method, headers=req_headers)\\\\n363 |         with urllib.request.urlopen(req, timeout=HF_URL_CHECK_TIMEOUT) as resp:\\\\n364 |             code = getattr(resp, \\\\\\\"status\\\\\\\", None) or resp.getcode()\\\\n365 |             return 200 \\\\u003c= int(code) \\\\u003c 400\\\\n366 | \\\",\\n        \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n        \\\"file_path\\\": \\\"model_discovery.py\\\",\\n        \\\"issue_type\\\": \\\"python_network_operations\\\",\\n        \\\"line_number\\\": 363,\\n        \\\"line_snippet\\\": \\\"with urllib.request.urlopen(req, timeout=HF_URL_CHECK_TIMEOUT) as resp:\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$http2\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"model_discovery.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$http2\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"        with urllib.request.urlopen(req, timeout=HF_URL_CHECK_TIMEOUT) as resp:\\\\n\\\",\\n                                    \\\"line_number\\\": 363,\\n                                    \\\"matched_data\\\": \\\"urllib.request.urlopen(\\\",\\n                                    \\\"matched_length\\\": 23,\\n                                    \\\"offset\\\": 13\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1041 Exfiltration Over C2 Channel\\\",\\n                \\\"attack_id2\\\": \\\"T1048 Exfiltration Over Alternative Protocol\\\",\\n                \\\"category\\\": \\\"Exfiltration\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1041/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-network-requests\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"2 | import urllib.request\\\\n3 | try:\\\\n4 |     req = urllib.request.Request(\\\\\\\"https://huggingface.co/api/models/black-forest-labs/FLUX.1-dev\\\\\\\")\\\\n5 |     resp = urllib.request.urlopen(req)\\\\n6 | except Exception as e:\\\\n7 |     print(type(e), e)\\\",\\n        \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n        \\\"file_path\\\": \\\"test_hf.py\\\",\\n        \\\"issue_type\\\": \\\"python_network_operations\\\",\\n        \\\"line_number\\\": 5,\\n        \\\"line_snippet\\\": \\\"resp = urllib.request.urlopen(req)\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$http2\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"test_hf.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$http2\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"    resp = urllib.request.urlopen(req)\\\\n\\\",\\n                                    \\\"line_number\\\": 5,\\n                                    \\\"matched_data\\\": \\\"urllib.request.urlopen(\\\",\\n                                    \\\"matched_length\\\": 23,\\n                                    \\\"offset\\\": 11\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1041 Exfiltration Over C2 Channel\\\",\\n                \\\"attack_id2\\\": \\\"T1048 Exfiltration Over Alternative Protocol\\\",\\n                \\\"category\\\": \\\"Exfiltration\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1041/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-network-requests\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"6820 |             }\\\\n6821 | \\\\n6822 |             const originalLoadGraphData = comfyApp.loadGraphData.bind(comfyApp);\\\\n6823 |             comfyApp.loadGraphData = async (...args) =\\\\u003e {\\\\n6824 |                 const loadedGraphData = normalizeWorkflowOpenGraphDataArg(args?.[0]);\\\\n6825 |                 workflowOpenLastTriggeredAt = 0;\\\\n6826 |                 workflowOpenLastHandledSignature = \\\\\\\"\\\\\\\";\\\",\\n        \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n        \\\"file_path\\\": \\\"js/auto_download.js\\\",\\n        \\\"issue_type\\\": \\\"python_network_operations\\\",\\n        \\\"line_number\\\": 6823,\\n        \\\"line_snippet\\\": \\\"comfyApp.loadGraphData = async (...args) =\\\\u003e {\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$socket4\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"js/auto_download.js\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$socket4\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"            comfyApp.loadGraphData = async (...args) =\\\\u003e {\\\\n\\\",\\n                                    \\\"line_number\\\": 6823,\\n                                    \\\"matched_data\\\": \\\".bind(\\\",\\n                                    \\\"matched_length\\\": 6,\\n                                    \\\"offset\\\": 2\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                executionErrorStore.surfaceMissingModels.bind(executionErrorStore);\\\\n\\\",\\n                                    \\\"line_number\\\": 6941,\\n                                    \\\"matched_data\\\": \\\".bind(\\\",\\n                                    \\\"matched_length\\\": 6,\\n                                    \\\"offset\\\": 75\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1041 Exfiltration Over C2 Channel\\\",\\n                \\\"attack_id2\\\": \\\"T1048 Exfiltration Over Alternative Protocol\\\",\\n                \\\"category\\\": \\\"Exfiltration\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1041/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-network-requests\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"150 |     for attempt in range(1, retries + 1):\\\\n151 |         req = urllib.request.Request(url, headers=headers)\\\\n152 |         try:\\\\n153 |             with urllib.request.urlopen(req, timeout=timeout) as resp:\\\\n154 |                 payload = resp.read()\\\\n155 |                 data = json.loads(payload.decode(\\\\\\\"utf-8\\\\\\\"))\\\\n156 |                 response_headers = {k.lower(): v for k, v in resp.headers.items()}\\\",\\n        \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n        \\\"file_path\\\": \\\"scripts/scrape_priority_repos_to_popular_models.py\\\",\\n        \\\"issue_type\\\": \\\"python_network_operations\\\",\\n        \\\"line_number\\\": 153,\\n        \\\"line_snippet\\\": \\\"with urllib.request.urlopen(req, timeout=timeout) as resp:\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$http2\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"scripts/scrape_priority_repos_to_popular_models.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$http2\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"            with urllib.request.urlopen(req, timeout=timeout) as resp:\\\\n\\\",\\n                                    \\\"line_number\\\": 153,\\n                                    \\\"matched_data\\\": \\\"urllib.request.urlopen(\\\",\\n                                    \\\"matched_length\\\": 23,\\n                                    \\\"offset\\\": 17\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1041 Exfiltration Over C2 Channel\\\",\\n                \\\"attack_id2\\\": \\\"T1048 Exfiltration Over Alternative Protocol\\\",\\n                \\\"category\\\": \\\"Exfiltration\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1041/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [],\\n        \\\"code_snippet\\\": \\\"{\\\\n  \\\\\\\"name\\\\\\\": \\\\\\\"ComfyUI_HuggingFace_Downloader\\\\\\\",\\\\n  \\\\\\\"lockfileVersion\\\\\\\": 3,\\\\n  \\\\\\\"requires\\\\\\\": true,\\\\n  \\\\\\\"packages\\\\\\\": {\\\\n\\\",\\n        \\\"description\\\": \\\"Vendored file identified and hash verified against upstream registry\\\",\\n        \\\"file_path\\\": \\\"package-lock.json\\\",\\n        \\\"issue_type\\\": \\\"vendored_known\\\",\\n        \\\"line_number\\\": 1,\\n        \\\"line_snippet\\\": \\\"{\\\",\\n        \\\"metadata\\\": {\\n            \\\"detection_reason\\\": \\\"npm lockfile (39 entries)\\\",\\n            \\\"ecosystem\\\": \\\"npm\\\",\\n            \\\"hash_verified\\\": true,\\n            \\\"lockfile_not_found\\\": 0,\\n            \\\"lockfile_registry_unavailable\\\": 0,\\n            \\\"lockfile_skipped_over_limit\\\": 0,\\n            \\\"lockfile_skipped_registry_down\\\": 0,\\n            \\\"lockfile_total_entries\\\": 39,\\n            \\\"lockfile_verified_match\\\": 39,\\n            \\\"lockfile_verified_mismatch\\\": 0\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"provenance_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    }\\n]\", \"by\": \"admin@comfy.org\"}]}","supported_accelerators":[],"supported_comfyui_frontend_version":"","supported_comfyui_version":"","supported_os":[],"tags":[],"tags_admin":[],"version":"1.34.18"},{"changelog":"","comfy_node_extract_status":"pending","createdAt":"2026-09-02T14:02:47.900601Z","dependencies":["huggingface_hub\u003e=0.20.0"],"deprecated":false,"downloadUrl":"https://cdn.comfy.org/jnx/ComfyUI_HuggingFace_Downloader/1.34.16/node.zip","id":"5e7939f3-a33e-4489-8486-4b0c8caa8676","node_id":"ComfyUI_HuggingFace_Downloader","status":"NodeVersionStatusBanned","status_reason":"{\"message\": \"policy-v0.3: path traversal / unconfined file side-effect (unauthenticated, CSRF-reachable) \\u2014 upload_chunk writes multipart chunk bytes with open(temp_file_path, 'wb'|'ab') then os.rename into target_dir = _resolve_model_search_paths(folder)[0]. The `folder` field is fully attacker-controlled and _resolve_model_search_paths (web_api.py:2450-2456) returns an absolute or path-like folder verbatim as the write root, so an attacker POSTs folder='/abs/\\u2026 (web_api.py:2790) [Rule 11]\", \"by\": \"drltdata@comfy.org\", \"statusHistory\": [{\"status\": \"NodeVersionStatusFlagged\", \"message\": \"[\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"credential-access\\\",\\n            \\\"system-modification\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"25 |                         pass\\\\n26 |                     finally:\\\\n27 |                         if orig_env_token is not None:\\\\n28 |                             os.environ[\\\\\\\"HF_TOKEN\\\\\\\"] = orig_env_token\\\\n29 |             raise e\\\\n30 | \\\\n31 |     huggingface_hub.file_download.hf_hub_download = _patched_hf_hub_download\\\",\\n        \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n        \\\"file_path\\\": \\\"__init__.py\\\",\\n        \\\"issue_type\\\": \\\"python_environment_manipulation\\\",\\n        \\\"line_number\\\": 28,\\n        \\\"line_snippet\\\": \\\"os.environ[\\\\\\\"HF_TOKEN\\\\\\\"] = orig_env_token\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$env_read1\\\",\\n                \\\"$env_mod1\\\",\\n                \\\"$env_mod4\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"__init__.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"                            os.environ[\\\\\\\"HF_TOKEN\\\\\\\"] = orig_env_token\\\\n\\\",\\n                                    \\\"line_number\\\": 28,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 28\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$env_mod1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"                            os.environ[\\\\\\\"HF_TOKEN\\\\\\\"] = orig_env_token\\\\n\\\",\\n                                    \\\"line_number\\\": 28,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\\\\\"HF_TOKEN\\\\\\\"] =\\\",\\n                                    \\\"matched_length\\\": 24,\\n                                    \\\"offset\\\": 28\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$env_mod4\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"                    orig_env_token = os.environ.pop(\\\\\\\"HF_TOKEN\\\\\\\", None)\\\\n\\\",\\n                                    \\\"line_number\\\": 21,\\n                                    \\\"matched_data\\\": \\\"os.environ.pop(\\\",\\n                                    \\\"matched_length\\\": 15,\\n                                    \\\"offset\\\": 37\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1574.007 Environment Variable Hijacking\\\",\\n                \\\"category\\\": \\\"Defense Evasion\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1574/007/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"system-modification\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"1090 |     Uses snapshot_download for faster parallel downloads.\\\\n1091 |     \\\\\\\"\\\\\\\"\\\\\\\"\\\\n1092 |     # Must be set BEFORE importing huggingface_hub so hf_xet reads it at import time.\\\\n1093 |     os.environ[\\\\\\\"HF_HUB_ENABLE_HF_XET\\\\\\\"] = \\\\\\\"0\\\\\\\"\\\\n1094 |     os.environ[\\\\\\\"HF_HUB_DISABLE_XET\\\\\\\"] = \\\\\\\"1\\\\\\\"\\\\n1095 | \\\\n1096 |     from huggingface_hub import snapshot_download, hf_hub_download\\\",\\n        \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n        \\\"file_path\\\": \\\"backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_environment_manipulation\\\",\\n        \\\"line_number\\\": 1093,\\n        \\\"line_snippet\\\": \\\"os.environ[\\\\\\\"HF_HUB_ENABLE_HF_XET\\\\\\\"] = \\\\\\\"0\\\\\\\"\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$env_read1\\\",\\n                \\\"$env_read3\\\",\\n                \\\"$env_mod1\\\",\\n                \\\"$proc_env1\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"backup.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"    os.environ[\\\\\\\"HF_HUB_ENABLE_HF_XET\\\\\\\"] = \\\\\\\"0\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 1093,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 4\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"    os.environ[\\\\\\\"HF_HUB_DISABLE_XET\\\\\\\"] = \\\\\\\"1\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 1094,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 4\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read3\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"        token = os.getenv(\\\\\\\"HF_TOKEN\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n\\\",\\n                                    \\\"line_number\\\": 495,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 16\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$env_mod1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"    os.environ[\\\\\\\"HF_HUB_ENABLE_HF_XET\\\\\\\"] = \\\\\\\"0\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 1093,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\\\\\"HF_HUB_ENABLE_HF_XET\\\\\\\"] =\\\",\\n                                    \\\"matched_length\\\": 36,\\n                                    \\\"offset\\\": 4\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"    os.environ[\\\\\\\"HF_HUB_DISABLE_XET\\\\\\\"] = \\\\\\\"1\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 1094,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\\\\\"HF_HUB_DISABLE_XET\\\\\\\"] =\\\",\\n                                    \\\"matched_length\\\": 34,\\n                                    \\\"offset\\\": 4\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$proc_env1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"            process = subprocess.run(\\\\n\\\",\\n                                    \\\"line_number\\\": 654,\\n                                    \\\"matched_data\\\": \\\"subprocess.run(\\\\n                [sys.executable, manager_cli_script, \\\\\\\"save-snapshot\\\\\\\"],\\\\n                capture_output=True,\\\\n                text=True,\\\\n                cwd=comfy_dir,\\\\n                env=\\\",\\n                                    \\\"matched_length\\\": 202,\\n                                    \\\"offset\\\": 22\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1574.007 Environment Variable Hijacking\\\",\\n                \\\"category\\\": \\\"Defense Evasion\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1574/007/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-network-requests\\\",\\n            \\\"system-modification\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"468 |                 \\\\\\\"import json, sys, os, urllib.request, shutil\\\\\\\\n\\\\\\\"\\\\n469 |                 \\\\\\\"use_xet = sys.argv[3] == '1'\\\\\\\\n\\\\\\\"\\\\n470 |                 \\\\\\\"if use_xet:\\\\\\\\n\\\\\\\"\\\\n471 |                 \\\\\\\"    os.environ['HF_HUB_DISABLE_XET'] = '0'\\\\\\\\n\\\\\\\"\\\\n472 |                 \\\\\\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '1'\\\\\\\\n\\\\\\\"\\\\n473 |                 \\\\\\\"else:\\\\\\\\n\\\\\\\"\\\\n474 |                 \\\\\\\"    os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\\\\\n\\\\\\\"\\\",\\n        \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n        \\\"file_path\\\": \\\"downloader.py\\\",\\n        \\\"issue_type\\\": \\\"python_environment_manipulation\\\",\\n        \\\"line_number\\\": 471,\\n        \\\"line_snippet\\\": \\\"\\\\\\\"    os.environ['HF_HUB_DISABLE_XET'] = '0'\\\\\\\\n\\\\\\\"\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$env_read1\\\",\\n                \\\"$env_read3\\\",\\n                \\\"$env_mod1\\\",\\n                \\\"$env_mod4\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"downloader.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_DISABLE_XET'] = '0'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 471,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '1'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 472,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 474,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '0'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 475,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"                os.environ['HF_TOKEN'] = orig_hf_token\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 508,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 33\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"            \\\\\\\"os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 977,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 13\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"            \\\\\\\"os.environ['HF_HUB_ENABLE_HF_XET'] = '0'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 978,\\n                                    \\\"matched_data\\\": \\\"os.environ[\\\",\\n                                    \\\"matched_length\\\": 11,\\n                                    \\\"offset\\\": 13\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read3\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"token_override = os.getenv(\\\\\\\"HF_TOKEN\\\\\\\")\\\\n\\\",\\n                                    \\\"line_number\\\": 29,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 17\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"_sha_max_env = os.getenv(\\\\\\\"HF_DOWNLOADER_SHA_MAX_BYTES\\\\\\\", \\\\\\\"0\\\\\\\")\\\\n\\\",\\n                                    \\\"line_number\\\": 30,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 15\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"    value = os.getenv(name)\\\\n\\\",\\n                                    \\\"line_number\\\": 38,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 12\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"        token = os.getenv(\\\\\\\"HF_TOKEN\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n\\\",\\n                                    \\\"line_number\\\": 185,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 16\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$env_mod1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_DISABLE_XET'] = '0'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 471,\\n                                    \\\"matched_data\\\": \\\"os.environ['HF_HUB_DISABLE_XET'] =\\\",\\n                                    \\\"matched_length\\\": 34,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '1'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 472,\\n                                    \\\"matched_data\\\": \\\"os.environ['HF_HUB_ENABLE_HF_XET'] =\\\",\\n                                    \\\"matched_length\\\": 36,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 474,\\n                                    \\\"matched_data\\\": \\\"os.environ['HF_HUB_DISABLE_XET'] =\\\",\\n                                    \\\"matched_length\\\": 34,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"    os.environ['HF_HUB_ENABLE_HF_XET'] = '0'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 475,\\n                                    \\\"matched_data\\\": \\\"os.environ['HF_HUB_ENABLE_HF_XET'] =\\\",\\n                                    \\\"matched_length\\\": 36,\\n                                    \\\"offset\\\": 21\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"                os.environ['HF_TOKEN'] = orig_hf_token\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 508,\\n                                    \\\"matched_data\\\": \\\"os.environ['HF_TOKEN'] =\\\",\\n                                    \\\"matched_length\\\": 24,\\n                                    \\\"offset\\\": 33\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"            \\\\\\\"os.environ['HF_HUB_DISABLE_XET'] = '1'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 977,\\n                                    \\\"matched_data\\\": \\\"os.environ['HF_HUB_DISABLE_XET'] =\\\",\\n                                    \\\"matched_length\\\": 34,\\n                                    \\\"offset\\\": 13\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"            \\\\\\\"os.environ['HF_HUB_ENABLE_HF_XET'] = '0'\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 978,\\n                                    \\\"matched_data\\\": \\\"os.environ['HF_HUB_ENABLE_HF_XET'] =\\\",\\n                                    \\\"matched_length\\\": 36,\\n                                    \\\"offset\\\": 13\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$env_mod4\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"                \\\\\\\"        orig_hf_token = os.environ.pop('HF_TOKEN', None)\\\\\\\\n\\\\\\\"\\\\n\\\",\\n                                    \\\"line_number\\\": 502,\\n                                    \\\"matched_data\\\": \\\"os.environ.pop(\\\",\\n                                    \\\"matched_length\\\": 15,\\n                                    \\\"offset\\\": 41\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1574.007 Environment Variable Hijacking\\\",\\n                \\\"category\\\": \\\"Defense Evasion\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1574/007/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"system-modification\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"44 | _nunchaku_blackwell_cache: bool | None = None\\\\n45 | _node_widget_schema_hints_cache: dict[str, list[dict[str, Any]]] | None = None\\\\n46 | \\\\n47 | HF_SEARCH_MAX_CALLS = int(os.getenv(\\\\\\\"HF_SEARCH_MAX_CALLS\\\\\\\", \\\\\\\"200\\\\\\\"))\\\\n48 | HF_SEARCH_RATE_LIMIT_SECONDS = int(os.getenv(\\\\\\\"HF_SEARCH_RATE_LIMIT_SECONDS\\\\\\\", \\\\\\\"300\\\\\\\"))\\\\n49 | HF_SEARCH_MAX_SECONDS = int(os.getenv(\\\\\\\"HF_SEARCH_MAX_SECONDS\\\\\\\", \\\\\\\"60\\\\\\\"))\\\\n50 | HF_SEARCH_CALL_TIMEOUT = int(os.getenv(\\\\\\\"HF_SEARCH_CALL_TIMEOUT\\\\\\\", \\\\\\\"20\\\\\\\"))\\\",\\n        \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n        \\\"file_path\\\": \\\"model_discovery.py\\\",\\n        \\\"issue_type\\\": \\\"python_environment_manipulation\\\",\\n        \\\"line_number\\\": 47,\\n        \\\"line_snippet\\\": \\\"HF_SEARCH_MAX_CALLS = int(os.getenv(\\\\\\\"HF_SEARCH_MAX_CALLS\\\\\\\", \\\\\\\"200\\\\\\\"))\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$env_read3\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"model_discovery.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read3\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"HF_SEARCH_MAX_CALLS = int(os.getenv(\\\\\\\"HF_SEARCH_MAX_CALLS\\\\\\\", \\\\\\\"200\\\\\\\"))\\\\n\\\",\\n                                    \\\"line_number\\\": 47,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 26\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"HF_SEARCH_RATE_LIMIT_SECONDS = int(os.getenv(\\\\\\\"HF_SEARCH_RATE_LIMIT_SECONDS\\\\\\\", \\\\\\\"300\\\\\\\"))\\\\n\\\",\\n                                    \\\"line_number\\\": 48,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 35\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"HF_SEARCH_MAX_SECONDS = int(os.getenv(\\\\\\\"HF_SEARCH_MAX_SECONDS\\\\\\\", \\\\\\\"60\\\\\\\"))\\\\n\\\",\\n                                    \\\"line_number\\\": 49,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 28\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"HF_SEARCH_CALL_TIMEOUT = int(os.getenv(\\\\\\\"HF_SEARCH_CALL_TIMEOUT\\\\\\\", \\\\\\\"20\\\\\\\"))\\\\n\\\",\\n                                    \\\"line_number\\\": 50,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 29\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"PRIORITY_REPO_SCAN_LIMIT = int(os.getenv(\\\\\\\"HF_PRIORITY_REPO_SCAN_LIMIT\\\\\\\", \\\\\\\"100\\\\\\\"))\\\\n\\\",\\n                                    \\\"line_number\\\": 51,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 31\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"HF_URL_CHECK_TIMEOUT = int(os.getenv(\\\\\\\"HF_URL_CHECK_TIMEOUT\\\\\\\", \\\\\\\"8\\\\\\\"))\\\\n\\\",\\n                                    \\\"line_number\\\": 52,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 27\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1574.007 Environment Variable Hijacking\\\",\\n                \\\"category\\\": \\\"Defense Evasion\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1574/007/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"system-modification\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"256 |         print(\\\\\\\"[restore][error] Cannot specify both --skip-models and --only-models.\\\\\\\")\\\\n257 |         sys.exit(1)\\\\n258 | \\\\n259 |     repo_id = os.environ.get(\\\\\\\"COMFYUI_BACKUP\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n260 |     if not repo_id:\\\\n261 |         print(\\\\\\\"[restore] COMFYUI_BACKUP environment variable is not set. Skipping restore.\\\\\\\")\\\\n262 |         sys.exit(0)\\\",\\n        \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n        \\\"file_path\\\": \\\"restore_backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_environment_manipulation\\\",\\n        \\\"line_number\\\": 259,\\n        \\\"line_snippet\\\": \\\"repo_id = os.environ.get(\\\\\\\"COMFYUI_BACKUP\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$env_read2\\\",\\n                \\\"$proc_env1\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"restore_backup.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read2\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"    repo_id = os.environ.get(\\\\\\\"COMFYUI_BACKUP\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n\\\",\\n                                    \\\"line_number\\\": 259,\\n                                    \\\"matched_data\\\": \\\"os.environ.get(\\\",\\n                                    \\\"matched_length\\\": 15,\\n                                    \\\"offset\\\": 14\\n                                }\\n                            ]\\n                        },\\n                        {\\n                            \\\"identifier\\\": \\\"$proc_env1\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"                subprocess.run(\\\\n\\\",\\n                                    \\\"line_number\\\": 391,\\n                                    \\\"matched_data\\\": \\\"subprocess.run(\\\\n                    [sys.executable, manager_cli, \\\\\\\"restore-snapshot\\\\\\\", merged_path],\\\\n                    cwd=comfy_dir, check=False, env=\\\",\\n                                    \\\"matched_length\\\": 152,\\n                                    \\\"offset\\\": 16\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1574.007 Environment Variable Hijacking\\\",\\n                \\\"category\\\": \\\"Defense Evasion\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1574/007/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"system-modification\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"2630 |             return repo\\\\n2631 |     except Exception:\\\\n2632 |         pass\\\\n2633 |     return os.getenv(\\\\\\\"COMFYUI_BACKUP\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n2634 | \\\\n2635 | \\\\n2636 | def _parse_size_limit(value, default=5.0) -\\\\u003e float:\\\",\\n        \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n        \\\"file_path\\\": \\\"web_api.py\\\",\\n        \\\"issue_type\\\": \\\"python_environment_manipulation\\\",\\n        \\\"line_number\\\": 2633,\\n        \\\"line_snippet\\\": \\\"return os.getenv(\\\\\\\"COMFYUI_BACKUP\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$env_read3\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"web_api.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read3\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"    return os.getenv(\\\\\\\"COMFYUI_BACKUP\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n\\\",\\n                                    \\\"line_number\\\": 2633,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 11\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"        runpod_id = os.getenv(\\\\\\\"RUNPOD_POD_ID\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n\\\",\\n                                    \\\"line_number\\\": 2662,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 20\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"        comfyui_backup_env = os.getenv(\\\\\\\"COMFYUI_BACKUP\\\\\\\", \\\\\\\"\\\\\\\").strip()\\\\n\\\",\\n                                    \\\"line_number\\\": 2664,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 29\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1574.007 Environment Variable Hijacking\\\",\\n                \\\"category\\\": \\\"Defense Evasion\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1574/007/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-folder-access\\\",\\n            \\\"credential-access\\\",\\n            \\\"system-modification\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"597 | \\\\n598 | def main() -\\\\u003e int:\\\\n599 |     args = parse_args()\\\\n600 |     token = os.getenv(\\\\\\\"HF_TOKEN\\\\\\\") or os.getenv(\\\\\\\"HUGGINGFACE_TOKEN\\\\\\\")\\\\n601 |     input_path = resolve_cli_path(args.input)\\\\n602 | \\\\n603 |     with input_path.open(\\\\\\\"r\\\\\\\", encoding=\\\\\\\"utf-8\\\\\\\") as f:\\\",\\n        \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n        \\\"file_path\\\": \\\"scripts/scrape_priority_repos_to_popular_models.py\\\",\\n        \\\"issue_type\\\": \\\"python_environment_manipulation\\\",\\n        \\\"line_number\\\": 600,\\n        \\\"line_snippet\\\": \\\"token = os.getenv(\\\\\\\"HF_TOKEN\\\\\\\") or os.getenv(\\\\\\\"HUGGINGFACE_TOKEN\\\\\\\")\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$env_read3\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"scripts/scrape_priority_repos_to_popular_models.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$env_read3\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"    token = os.getenv(\\\\\\\"HF_TOKEN\\\\\\\") or os.getenv(\\\\\\\"HUGGINGFACE_TOKEN\\\\\\\")\\\\n\\\",\\n                                    \\\"line_number\\\": 600,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 12\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"    token = os.getenv(\\\\\\\"HF_TOKEN\\\\\\\") or os.getenv(\\\\\\\"HUGGINGFACE_TOKEN\\\\\\\")\\\\n\\\",\\n                                    \\\"line_number\\\": 600,\\n                                    \\\"matched_data\\\": \\\"os.getenv(\\\",\\n                                    \\\"matched_length\\\": 10,\\n                                    \\\"offset\\\": 37\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1574.007 Environment Variable Hijacking\\\",\\n                \\\"category\\\": \\\"Defense Evasion\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects environment variable manipulation and reading\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1574/007/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"651 |             env = os.environ.copy()\\\\n652 |             env[\\\\\\\"COMFYUI_PATH\\\\\\\"] = comfy_dir\\\\n653 | \\\\n654 |             process = subprocess.run(\\\\n655 |                 [sys.executable, manager_cli_script, \\\\\\\"save-snapshot\\\\\\\"],\\\\n656 |                 capture_output=True,\\\\n657 |                 text=True,\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 654,\\n        \\\"line_snippet\\\": \\\"process = subprocess.run(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_run_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"797 |                         continue\\\\n798 | \\\\n799 |                     print(f\\\\\\\"[INFO] Cloning: {repo_url}\\\\\\\")\\\\n800 |                     clone_result = subprocess.run(\\\\n801 |                         [\\\\\\\"git\\\\\\\", \\\\\\\"clone\\\\\\\", repo_url],\\\\n802 |                         capture_output=True,\\\\n803 |                         text=True,\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 800,\\n        \\\"line_snippet\\\": \\\"clone_result = subprocess.run(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_run_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"826 |                 try:\\\\n827 |                     print(f\\\\\\\"[INFO] Installing CNR node: {node_name}\\\\\\\")\\\\n828 |                     # Answer N to tracking prompt for each node installation\\\\n829 |                     process = subprocess.Popen(\\\\n830 |                         [\\\\\\\"comfy\\\\\\\", \\\\\\\"node\\\\\\\", \\\\\\\"install\\\\\\\", node_name],\\\\n831 |                         stdin=subprocess.PIPE,\\\\n832 |                         stdout=subprocess.PIPE,\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 829,\\n        \\\"line_snippet\\\": \\\"process = subprocess.Popen(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_popen_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\",\\n            \\\"any-folder-access\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"558 |                     with open(payload_path, \\\\\\\"w\\\\\\\", encoding=\\\\\\\"utf-8\\\\\\\") as f:\\\\n559 |                         json.dump(download_kwargs, f)\\\\n560 | \\\\n561 |                     proc = subprocess.Popen(\\\\n562 |                         [sys.executable, \\\\\\\"-u\\\\\\\", \\\\\\\"-c\\\\\\\", script, payload_path, result_path, xet_flag],\\\\n563 |                         stdout=subprocess.PIPE,\\\\n564 |                         stderr=subprocess.STDOUT,\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"downloader.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 561,\\n        \\\"line_snippet\\\": \\\"proc = subprocess.Popen(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_popen_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\",\\n            \\\"any-folder-access\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"1007 |             with open(payload_path, \\\\\\\"w\\\\\\\", encoding=\\\\\\\"utf-8\\\\\\\") as f:\\\\n1008 |                 json.dump(download_kwargs, f)\\\\n1009 | \\\\n1010 |             proc = subprocess.Popen(\\\\n1011 |                 [sys.executable, \\\\\\\"-u\\\\\\\", \\\\\\\"-c\\\\\\\", script, payload_path, result_path],\\\\n1012 |                 stdout=subprocess.PIPE,\\\\n1013 |                 stderr=subprocess.STDOUT,\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"downloader.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 1010,\\n        \\\"line_snippet\\\": \\\"proc = subprocess.Popen(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_popen_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"79 | def _remote_head(repo_url: str) -\\\\u003e str:\\\\n80 |     errors = []\\\\n81 |     for candidate in _candidate_repo_urls(repo_url):\\\\n82 |         proc = subprocess.run(\\\\n83 |             [\\\\\\\"git\\\\\\\", \\\\\\\"ls-remote\\\\\\\", candidate, \\\\\\\"HEAD\\\\\\\"],\\\\n84 |             text=True, capture_output=True, check=False\\\\n85 |         )\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"restore_backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 82,\\n        \\\"line_snippet\\\": \\\"proc = subprocess.run(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_run_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\",\\n            \\\"any-folder-access\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"353 |             print(\\\\\\\"[restore] Merging custom nodes snapshot...\\\\\\\")\\\\n354 |             current_snapshot_path = os.path.join(tmp_dir, \\\\\\\"current_snapshot.yaml\\\\\\\")\\\\n355 |             # Save current snapshot\\\\n356 |             subprocess.run(\\\\n357 |                 [sys.executable, manager_cli, \\\\\\\"save-snapshot\\\\\\\", \\\\\\\"--output\\\\\\\", current_snapshot_path],\\\\n358 |                 cwd=comfy_dir, check=False, stdout=subprocess.DEVNULL\\\\n359 |             )\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"restore_backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 356,\\n        \\\"line_snippet\\\": \\\"subprocess.run(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_run_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-code-execute\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"388 |                 print(\\\\\\\"[restore] Calling cm-cli.py restore-snapshot...\\\\\\\")\\\\n389 |                 env = os.environ.copy()\\\\n390 |                 env[\\\\\\\"PIP_NO_COMPILE\\\\\\\"] = \\\\\\\"1\\\\\\\"\\\\n391 |                 subprocess.run(\\\\n392 |                     [sys.executable, manager_cli, \\\\\\\"restore-snapshot\\\\\\\", merged_path],\\\\n393 |                     cwd=comfy_dir, check=False, env=env\\\\n394 |                 )\\\",\\n        \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n        \\\"file_path\\\": \\\"restore_backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_command_injection_risk\\\",\\n        \\\"line_number\\\": 391,\\n        \\\"line_snippet\\\": \\\"subprocess.run(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1059.004 Unix Shell\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$subprocess_run_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1059.004 Unix Shell\\\",\\n                \\\"category\\\": \\\"Injection\\\",\\n                \\\"confidence_note\\\": \\\"All patterns are _direct (95% confidence): each match represents an explicit invocation of a dangerous function.\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects all os.system and subprocess usage for potential command injection vulnerabilities\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1059/004/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"CIR-001..006\\\",\\n                \\\"version\\\": \\\"1.1\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_command_injection_risk\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [],\\n        \\\"code_snippet\\\": \\\"797 |                         continue\\\\n798 | \\\\n799 |                     print(f\\\\\\\"[INFO] Cloning: {repo_url}\\\\\\\")\\\\n800 |                     clone_result = subprocess.run(\\\\n801 |                         [\\\\\\\"git\\\\\\\", \\\\\\\"clone\\\\\\\", repo_url],\\\\n802 |                         capture_output=True,\\\\n803 |                         text=True,\\\",\\n        \\\"description\\\": \\\"Detects execution of git clone, git pull, and git fetch commands from Python code, indicating potential supply chain compromise\\\",\\n        \\\"file_path\\\": \\\"backup.py\\\",\\n        \\\"issue_type\\\": \\\"python_git_clone_execution\\\",\\n        \\\"line_number\\\": 800,\\n        \\\"line_snippet\\\": \\\"clone_result = subprocess.run(\\\",\\n        \\\"metadata\\\": {\\n            \\\"attack_id\\\": [\\n                \\\"T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools\\\"\\n            ],\\n            \\\"confidence\\\": 95,\\n            \\\"matched_patterns\\\": [\\n                \\\"$clone_subprocess_list_direct\\\"\\n            ],\\n            \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1195/001/\\\",\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools\\\",\\n                \\\"category\\\": \\\"Supply Chain\\\",\\n                \\\"confidence_note\\\": \\\"Patterns ending with _direct have high confidence (95%), including both immediate execution calls and high-confidence execution-prep patterns (e.g., clone list assignment) where the semantic risk is equivalent. Patterns ending with _autoupdate have medium confidence (75%) due to some legitimate auto-update uses. Confidence tiers reflect semantic risk level (clone=high, pull/fetch=medium), not code form.\\\",\\n                \\\"date\\\": \\\"2025-02-16\\\",\\n                \\\"description\\\": \\\"Detects execution of git clone, git pull, and git fetch commands from Python code, indicating potential supply chain compromise\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1195/001/\\\",\\n                \\\"severity\\\": \\\"4\\\",\\n                \\\"traceability\\\": \\\"Pattern IDs: GCE-001..GCE-015. See docs/PATTERN_TRACEABILITY.md\\\",\\n                \\\"version\\\": \\\"1.2\\\"\\n            },\\n            \\\"yara_rule\\\": \\\"python_git_clone_execution\\\"\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-network-requests\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"751 |                 status_cb(\\\\\\\"downloading\\\\\\\")\\\\n752 | \\\\n753 |             request = urllib.request.Request(raw_url, headers=request_headers, method=\\\\\\\"GET\\\\\\\")\\\\n754 |             with urllib.request.urlopen(request, timeout=60) as response:\\\\n755 |                 final_url = str(getattr(response, \\\\\\\"geturl\\\\\\\", lambda: raw_url)() or raw_url)\\\\n756 |                 headers = getattr(response, \\\\\\\"headers\\\\\\\", {})\\\\n757 |                 content_disposition = \\\\\\\"\\\\\\\"\\\",\\n        \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n        \\\"file_path\\\": \\\"downloader.py\\\",\\n        \\\"issue_type\\\": \\\"python_network_operations\\\",\\n        \\\"line_number\\\": 754,\\n        \\\"line_snippet\\\": \\\"with urllib.request.urlopen(request, timeout=60) as response:\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$http2\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"downloader.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$http2\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"            with urllib.request.urlopen(request, timeout=60) as response:\\\\n\\\",\\n                                    \\\"line_number\\\": 754,\\n                                    \\\"matched_data\\\": \\\"urllib.request.urlopen(\\\",\\n                                    \\\"matched_length\\\": 23,\\n                                    \\\"offset\\\": 17\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1041 Exfiltration Over C2 Channel\\\",\\n                \\\"attack_id2\\\": \\\"T1048 Exfiltration Over Alternative Protocol\\\",\\n                \\\"category\\\": \\\"Exfiltration\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1041/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-network-requests\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"360 |         if extra_headers:\\\\n361 |             req_headers.update(extra_headers)\\\\n362 |         req = urllib.request.Request(url, method=method, headers=req_headers)\\\\n363 |         with urllib.request.urlopen(req, timeout=HF_URL_CHECK_TIMEOUT) as resp:\\\\n364 |             code = getattr(resp, \\\\\\\"status\\\\\\\", None) or resp.getcode()\\\\n365 |             return 200 \\\\u003c= int(code) \\\\u003c 400\\\\n366 | \\\",\\n        \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n        \\\"file_path\\\": \\\"model_discovery.py\\\",\\n        \\\"issue_type\\\": \\\"python_network_operations\\\",\\n        \\\"line_number\\\": 363,\\n        \\\"line_snippet\\\": \\\"with urllib.request.urlopen(req, timeout=HF_URL_CHECK_TIMEOUT) as resp:\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$http2\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"model_discovery.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$http2\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"        with urllib.request.urlopen(req, timeout=HF_URL_CHECK_TIMEOUT) as resp:\\\\n\\\",\\n                                    \\\"line_number\\\": 363,\\n                                    \\\"matched_data\\\": \\\"urllib.request.urlopen(\\\",\\n                                    \\\"matched_length\\\": 23,\\n                                    \\\"offset\\\": 13\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1041 Exfiltration Over C2 Channel\\\",\\n                \\\"attack_id2\\\": \\\"T1048 Exfiltration Over Alternative Protocol\\\",\\n                \\\"category\\\": \\\"Exfiltration\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1041/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-network-requests\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"2 | import urllib.request\\\\n3 | try:\\\\n4 |     req = urllib.request.Request(\\\\\\\"https://huggingface.co/api/models/black-forest-labs/FLUX.1-dev\\\\\\\")\\\\n5 |     resp = urllib.request.urlopen(req)\\\\n6 | except Exception as e:\\\\n7 |     print(type(e), e)\\\",\\n        \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n        \\\"file_path\\\": \\\"test_hf.py\\\",\\n        \\\"issue_type\\\": \\\"python_network_operations\\\",\\n        \\\"line_number\\\": 5,\\n        \\\"line_snippet\\\": \\\"resp = urllib.request.urlopen(req)\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$http2\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"test_hf.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$http2\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"    resp = urllib.request.urlopen(req)\\\\n\\\",\\n                                    \\\"line_number\\\": 5,\\n                                    \\\"matched_data\\\": \\\"urllib.request.urlopen(\\\",\\n                                    \\\"matched_length\\\": 23,\\n                                    \\\"offset\\\": 11\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1041 Exfiltration Over C2 Channel\\\",\\n                \\\"attack_id2\\\": \\\"T1048 Exfiltration Over Alternative Protocol\\\",\\n                \\\"category\\\": \\\"Exfiltration\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1041/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-network-requests\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"6820 |             }\\\\n6821 | \\\\n6822 |             const originalLoadGraphData = comfyApp.loadGraphData.bind(comfyApp);\\\\n6823 |             comfyApp.loadGraphData = async (...args) =\\\\u003e {\\\\n6824 |                 const loadedGraphData = normalizeWorkflowOpenGraphDataArg(args?.[0]);\\\\n6825 |                 workflowOpenLastTriggeredAt = 0;\\\\n6826 |                 workflowOpenLastHandledSignature = \\\\\\\"\\\\\\\";\\\",\\n        \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n        \\\"file_path\\\": \\\"js/auto_download.js\\\",\\n        \\\"issue_type\\\": \\\"python_network_operations\\\",\\n        \\\"line_number\\\": 6823,\\n        \\\"line_snippet\\\": \\\"comfyApp.loadGraphData = async (...args) =\\\\u003e {\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$socket4\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"js/auto_download.js\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$socket4\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"            comfyApp.loadGraphData = async (...args) =\\\\u003e {\\\\n\\\",\\n                                    \\\"line_number\\\": 6823,\\n                                    \\\"matched_data\\\": \\\".bind(\\\",\\n                                    \\\"matched_length\\\": 6,\\n                                    \\\"offset\\\": 2\\n                                },\\n                                {\\n                                    \\\"line\\\": \\\"                executionErrorStore.surfaceMissingModels.bind(executionErrorStore);\\\\n\\\",\\n                                    \\\"line_number\\\": 6941,\\n                                    \\\"matched_data\\\": \\\".bind(\\\",\\n                                    \\\"matched_length\\\": 6,\\n                                    \\\"offset\\\": 75\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1041 Exfiltration Over C2 Channel\\\",\\n                \\\"attack_id2\\\": \\\"T1048 Exfiltration Over Alternative Protocol\\\",\\n                \\\"category\\\": \\\"Exfiltration\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1041/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [\\n            \\\"any-network-requests\\\"\\n        ],\\n        \\\"code_snippet\\\": \\\"150 |     for attempt in range(1, retries + 1):\\\\n151 |         req = urllib.request.Request(url, headers=headers)\\\\n152 |         try:\\\\n153 |             with urllib.request.urlopen(req, timeout=timeout) as resp:\\\\n154 |                 payload = resp.read()\\\\n155 |                 data = json.loads(payload.decode(\\\\\\\"utf-8\\\\\\\"))\\\\n156 |                 response_headers = {k.lower(): v for k, v in resp.headers.items()}\\\",\\n        \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n        \\\"file_path\\\": \\\"scripts/scrape_priority_repos_to_popular_models.py\\\",\\n        \\\"issue_type\\\": \\\"python_network_operations\\\",\\n        \\\"line_number\\\": 153,\\n        \\\"line_snippet\\\": \\\"with urllib.request.urlopen(req, timeout=timeout) as resp:\\\",\\n        \\\"metadata\\\": {\\n            \\\"confidence\\\": 90,\\n            \\\"matched_patterns\\\": [\\n                \\\"$http2\\\"\\n            ],\\n            \\\"yara_matches\\\": [\\n                {\\n                    \\\"filepath\\\": \\\"scripts/scrape_priority_repos_to_popular_models.py\\\",\\n                    \\\"strings\\\": [\\n                        {\\n                            \\\"identifier\\\": \\\"$http2\\\",\\n                            \\\"instances\\\": [\\n                                {\\n                                    \\\"line\\\": \\\"            with urllib.request.urlopen(req, timeout=timeout) as resp:\\\\n\\\",\\n                                    \\\"line_number\\\": 153,\\n                                    \\\"matched_data\\\": \\\"urllib.request.urlopen(\\\",\\n                                    \\\"matched_length\\\": 23,\\n                                    \\\"offset\\\": 17\\n                                }\\n                            ]\\n                        }\\n                    ]\\n                }\\n            ],\\n            \\\"yara_meta\\\": {\\n                \\\"attack_id1\\\": \\\"T1041 Exfiltration Over C2 Channel\\\",\\n                \\\"attack_id2\\\": \\\"T1048 Exfiltration Over Alternative Protocol\\\",\\n                \\\"category\\\": \\\"Exfiltration\\\",\\n                \\\"date\\\": \\\"2025-06-30\\\",\\n                \\\"description\\\": \\\"Detects network operations and potential data exfiltration patterns\\\",\\n                \\\"reference\\\": \\\"https://attack.mitre.org/techniques/T1041/\\\",\\n                \\\"severity\\\": \\\"3\\\",\\n                \\\"version\\\": \\\"1.0\\\"\\n            }\\n        },\\n        \\\"recommendation\\\": \\\"\\\",\\n        \\\"scanner\\\": \\\"yara_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    },\\n    {\\n        \\\"admin_tags\\\": [],\\n        \\\"code_snippet\\\": \\\"{\\\\n  \\\\\\\"name\\\\\\\": \\\\\\\"ComfyUI_HuggingFace_Downloader\\\\\\\",\\\\n  \\\\\\\"lockfileVersion\\\\\\\": 3,\\\\n  \\\\\\\"requires\\\\\\\": true,\\\\n  \\\\\\\"packages\\\\\\\": {\\\\n\\\",\\n        \\\"description\\\": \\\"Vendored file identified and hash verified against upstream registry\\\",\\n        \\\"file_path\\\": \\\"package-lock.json\\\",\\n        \\\"issue_type\\\": \\\"vendored_known\\\",\\n        \\\"line_number\\\": 1,\\n        \\\"line_snippet\\\": \\\"{\\\",\\n        \\\"metadata\\\": {\\n            \\\"detection_reason\\\": \\\"npm lockfile (39 entries)\\\",\\n            \\\"ecosystem\\\": \\\"npm\\\",\\n            \\\"hash_verified\\\": true,\\n            \\\"lockfile_not_found\\\": 0,\\n            \\\"lockfile_registry_unavailable\\\": 0,\\n            \\\"lockfile_skipped_over_limit\\\": 0,\\n            \\\"lockfile_skipped_registry_down\\\": 0,\\n            \\\"lockfile_total_entries\\\": 39,\\n            \\\"lockfile_verified_match\\\": 39,\\n            \\\"lockfile_verified_mismatch\\\": 0\\n        },\\n        \\\"recommendation\\\": null,\\n        \\\"scanner\\\": \\\"provenance_scan\\\",\\n        \\\"severity\\\": \\\"info\\\"\\n    }\\n]\", \"by\": \"admin@comfy.org\"}]}","supported_accelerators":[],"supported_comfyui_frontend_version":"","supported_comfyui_version":"","supported_os":[],"tags":[],"tags_admin":[],"version":"1.34.16"},{"changelog":"","comfy_node_extract_status":"pending","createdAt":"2026-07-29T11:15:16.033317Z","dependencies":["huggingface_hub\u003e=0.20.0"],"deprecated":false,"downloadUrl":"https://cdn.comfy.org/jnx/ComfyUI_HuggingFace_Downloader/1.34.14/node.zip","id":"76ba9eaf-5328-40c5-b09e-bfe8c8abb946","node_id":"ComfyUI_HuggingFace_Downloader","status":"NodeVersionStatusActive","status_reason":"Passed automated checks","supported_accelerators":[],"supported_comfyui_frontend_version":"","supported_comfyui_version":"","supported_os":[],"tags":[],"tags_admin":[],"version":"1.34.14"},{"changelog":"","comfy_node_extract_status":"pending","createdAt":"2026-07-28T00:37:31.159389Z","dependencies":["huggingface_hub\u003e=0.20.0"],"deprecated":false,"downloadUrl":"https://cdn.comfy.org/jnx/ComfyUI_HuggingFace_Downloader/1.34.13/node.zip","id":"b0216853-478f-43a0-8f04-42ac8fb375d0","node_id":"ComfyUI_HuggingFace_Downloader","status":"NodeVersionStatusActive","status_reason":"Passed automated checks","supported_accelerators":[],"supported_comfyui_frontend_version":"","supported_comfyui_version":"","supported_os":[],"tags":[],"tags_admin":[],"version":"1.34.13"},{"changelog":"","comfy_node_extract_status":"pending","createdAt":"2026-07-28T00:23:45.37688Z","dependencies":["huggingface_hub\u003e=0.20.0"],"deprecated":false,"downloadUrl":"https://cdn.comfy.org/jnx/ComfyUI_HuggingFace_Downloader/1.34.12/node.zip","id":"07442565-a36a-47d8-a141-503d59dc4944","node_id":"ComfyUI_HuggingFace_Downloader","status":"NodeVersionStatusActive","status_reason":"Passed automated checks","supported_accelerators":[],"supported_comfyui_frontend_version":"","supported_comfyui_version":"","supported_os":[],"tags":[],"tags_admin":[],"version":"1.34.12"},{"changelog":"","comfy_node_extract_status":"pending","createdAt":"2026-07-28T00:19:42.719056Z","dependencies":["huggingface_hub\u003e=0.20.0"],"deprecated":false,"downloadUrl":"https://cdn.comfy.org/jnx/ComfyUI_HuggingFace_Downloader/1.34.11/node.zip","id":"33c63a94-d15b-409e-a24e-0ba273212e90","node_id":"ComfyUI_HuggingFace_Downloader","status":"NodeVersionStatusActive","status_reason":"Passed automated checks","supported_accelerators":[],"supported_comfyui_frontend_version":"","supported_comfyui_version":"","supported_os":[],"tags":[],"tags_admin":[],"version":"1.34.11"},{"changelog":"","comfy_node_extract_status":"pending","createdAt":"2026-07-28T00:17:07.461313Z","dependencies":["huggingface_hub\u003e=0.20.0"],"deprecated":false,"downloadUrl":"https://cdn.comfy.org/jnx/ComfyUI_HuggingFace_Downloader/1.34.10/node.zip","id":"1d79bae5-55a3-47f2-85d8-1911f466b634","node_id":"ComfyUI_HuggingFace_Downloader","status":"NodeVersionStatusActive","status_reason":"Passed automated checks","supported_accelerators":[],"supported_comfyui_frontend_version":"","supported_comfyui_version":"","supported_os":[],"tags":[],"tags_admin":[],"version":"1.34.10"}]}