Comfy-Org / Comfy-Org/ComfyUI-Manager

Manual review request for flagged node version: wextraui 0.3.3

Open
#3,245 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
16.1k
Forks
2.5k
Avg merge
5d 4h
Merged PRs (30d)
13

Description

Hi, I'm the publisher of **wextraui** (@sickbraintwo), https://registry.comfy.org/nodes/wextraui — repo https://github.com/sickbraintwo/WextraUI (Apache 2.0).

Both published versions are stuck in `NodeVersionStatusFlagged` with no reason shown:
- 0.3.2 — published via the GitHub Action, flagged
- 0.3.3 — same code with the Windows console banner removed (it used `ctypes`/`CONOUT$` for colours; I assumed that was the trigger), flagged again

The package is small (71 files, 1.2 MB, no compiled files, no dependencies). The only things in it that could look suspicious to an automated scan:

1. `src/loraInfo.py` — one outbound HTTPS request to `https://civitai.com/api/v1/model-versions/by-hash/` (stdlib `urllib`, GET only, 12 s timeout) to fetch a LoRA's name and trigger words by its hash. Results are cached as small JSON files under `output/_Wextra/lora/`. Fails silently when offline. This is the core feature of the "WLoad Lora & Trigger" node.
2. Standard file writes under ComfyUI's `output/` directory (image saving, the cache above).

No `subprocess`, `eval`/`exec`, pip installs, custom wheels or obfuscated code. Everything is plain readable Python + a small JS frontend extension.

Could you take a look and tell me what triggered the flag? If the civitai lookup is the issue I'm happy to adapt (e.g. opt-in toggle) — I just need to know what to change. Thanks!

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing how published node versions become NodeVersionStatusFlagged, then compare the 0.3.2 and 0.3.3 submissions. Review the publisher's cited GitHub Action and the package files src/loraInfo.py and its JavaScript frontend extension; done means identifying the flag trigger and documenting the required change or review outcome.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, javascript, python
Domain
release, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.