Audit Installed Nodes (TensorTrap)

The pitch

Here's the uncomfortable fact about ComfyUI: installing a custom node is running an executable. ComfyUI Manager clones a repo and runs pip install - no signature check, no code review - and the code executes with full access to your user account. The June 2024 LLMVISION incident, an infostealer hidden inside fake library wheels that harvested browser passwords and eventually ended in a federal prosecution, is the canonical demonstration. Nothing structural changed afterward; the install path works today exactly the way it did the day that malware shipped.

Audit Installed Nodes (TensorTrap) is the pack's answer to "so what's already sitting in my custom_nodes/ folder?" It's a static-analysis sweep over every installed package, built to catch the patterns a malicious node needs to do damage. Run it once, and you'll know more about your own install than you did before.

How it works

The node scans every package under custom_nodes/, parses each Python file to an AST, and hunts for the categories that matter:

• eval(), exec(), compile() - code injection
• subprocess, os.system, os.popen - command execution
• requests, urllib, socket - network access / exfiltration
• pickle.loads - deserialization attacks
• Obfuscation: PyArmor, base64/hex-encoded payloads
• Suspicious binaries: .exe, .dll, .so riding along in a node pack

The key word is static. It parses the source; it never imports or runs any of it. That's the right way to triage code you don't trust, and it's fast enough to fire after every update.

A package is flagged when it has any CRITICAL or HIGH finding - and here's the nuance that matters: a flag is not a verdict. Half the ecosystem uses requests to download models, and that's completely normal. Think of this node as a triage list: it tells you where to look, ranked by severity, with file and line numbers.

Inputs and outputs

The only input is trigger, an any-type slot. It exists so you can wire literally anything into it to anchor the audit in a sequence; you can also just drop the node on the canvas and queue it.

Outputs:

• audit_report - STRING, the human-readable per-package report. Wire it to a Show Text / Display String node.
• total_packages - INT, how many packages were scanned.
• packages_with_issues - INT, how many came back flagged.

How to install it

Same as the rest of the pack:

cd ComfyUI/custom_nodes
git clone https://github.com/realmarauder/ComfyUI-TensorTrap.git
pip install tensortrap

Restart ComfyUI (or use ComfyUI Manager → search "TensorTrap"). The scanner is bundled in the pack, so this node runs fine without the tensortrap pip package.

Using it, and the honest limits

The README's advice is right: run this after every git pull or ComfyUI Manager install, when new code lands in your environment. Build a tiny side workflow - Audit Installed Nodes → audit_report → Show Text - and queue it. You get a per-package report: files scanned, finding count, and the first five findings with file:line references (it truncates at five per package and says "...and N more").

Two things worth knowing:

• A trusted pack showing a flag isn't a broken false positive. If RES4LYF or another pack you rely on throws a HIGH, file an issue with the maintainer. That's literally how the RES4LYF #252 pickle finding got reported and fixed. Static scanners find the pattern; a human decides whether it's the dangerous kind.
• It scans its own folder too. ComfyUI-TensorTrap lives in custom_nodes/, so it shows up in every run's results. Seeing it in the list is expected, not a red flag.

The honest limit: static analysis catches known shapes. A genuinely novel obfuscator can slip past pattern rules. Treat this as your cheapest always-on triage, not a guarantee that your install is bulletproof.