[GH-ISSUE #3206] pack stuck on flagged for manual review #1116

New issue

Open

opened 2026-10-27 21:25:54 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-27 21:25:54 +00:00

Owner

Originally created by @vtokic on GitHub (Aug 25, 2026).
Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/3206

vtokic/comfyui-cable-management (barney-tearspell, cable-management pack)
two versions approved by @ltdrdata three weeks ago, bugfixes and features submitted after that stuck on flagged with the identical issue

ai assisted diagnosis

suspicion: the scanner's python socket YARA rules are being run against .js.
all 8 findings on our 1.2.1 are python_network_operations / any-network-requests
at confidence 90, and every one resolves to two raw substrings:

pattern	matched	what it actually is
$socket3	`.connect(`	litegraph `node.connect(slot, target, idx)`
$socket4	`.bind(`	`Function.prototype.bind`

no parsing, no language awareness — one of our findings is reported against a
line that is a comment. any pack touching litegraph's link API trips this, which
would explain why this isn't isolated to one publisher.

the tell: our 1.0.0/1.0.1 carry the identical findings in their
statusHistory and are only Active because they were hand-approved. nothing
regressed in our code after that — the finding count grew because the pack grew.
so this isn't versions going bad, it's every version being flagged and only some
getting a manual pass.

also worth noting /security-scan only pulls pending versions, so nothing
re-examines a flagged one. it's terminal without a human, no queue, no expiry.

Originally created by @vtokic on GitHub (Aug 25, 2026). Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/3206 `vtokic/comfyui-cable-management` (barney-tearspell, `cable-management` pack) two versions approved by @ltdrdata three weeks ago, bugfixes and features submitted after that stuck on flagged with the identical issue **ai assisted diagnosis** suspicion: the scanner's python socket YARA rules are being run against `.js`. all 8 findings on our 1.2.1 are `python_network_operations` / `any-network-requests` at confidence 90, and every one resolves to two raw substrings: | pattern | matched | what it actually is | |----------|----------|----------------------------| | $socket3 | `.connect(` | litegraph `node.connect(slot, target, idx)` | | $socket4 | `.bind(` | `Function.prototype.bind` | no parsing, no language awareness — one of our findings is reported against a line that is a comment. any pack touching litegraph's link API trips this, which would explain why this isn't isolated to one publisher. the tell: our 1.0.0/1.0.1 carry the **identical** findings in their `statusHistory` and are only Active because they were hand-approved. nothing regressed in our code after that — the finding count grew because the pack grew. so this isn't versions going bad, it's every version being flagged and only some getting a manual pass. also worth noting `/security-scan` only pulls *pending* versions, so nothing re-examines a flagged one. it's terminal without a human, no queue, no expiry.