Comfy-Org / Comfy-Org/ComfyUI-Manager
Manual review request for flagged node version: wextraui 0.3.3
- Dominant language
- Python
- Stars
- 16.1k
- Forks
- 2.5k
- Avg merge
- 5d 4h
- Merged PRs (30d)
- 13
Description
Hi, I'm the publisher of **wextraui** (@sickbraintwo), https://registry.comfy.org/nodes/wextraui — repo https://github.com/sickbraintwo/WextraUI (Apache 2.0).
Both published versions are stuck in `NodeVersionStatusFlagged` with no reason shown:
- 0.3.2 — published via the GitHub Action, flagged
- 0.3.3 — same code with the Windows console banner removed (it used `ctypes`/`CONOUT$` for colours; I assumed that was the trigger), flagged again
The package is small (71 files, 1.2 MB, no compiled files, no dependencies). The only things in it that could look suspicious to an automated scan:
1. `src/loraInfo.py` — one outbound HTTPS request to `https://civitai.com/api/v1/model-versions/by-hash/` (stdlib `urllib`, GET only, 12 s timeout) to fetch a LoRA's name and trigger words by its hash. Results are cached as small JSON files under `output/_Wextra/lora/`. Fails silently when offline. This is the core feature of the "WLoad Lora & Trigger" node.
2. Standard file writes under ComfyUI's `output/` directory (image saving, the cache above).
No `subprocess`, `eval`/`exec`, pip installs, custom wheels or obfuscated code. Everything is plain readable Python + a small JS frontend extension.
Could you take a look and tell me what triggered the flag? If the civitai lookup is the issue I'm happy to adapt (e.g. opt-in toggle) — I just need to know what to change. Thanks!
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing how published node versions become NodeVersionStatusFlagged, then compare the 0.3.2 and 0.3.3 submissions. Review the publisher's cited GitHub Action and the package files src/loraInfo.py and its JavaScript frontend extension; done means identifying the flag trigger and documenting the required change or review outcome.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, javascript, python
- Domain
- release, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100