
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Make PRs that publishes ComfyUI Custom Nodes to [ComfyUI Registry]( https://www.comfyregistry.org/ ).
Make PRs that helps comfy community grow with Comfy.org.
If you wish to change which Github account the Pull Requests come from, then you need to place a Github token into the Actions Secrets
GH_TOKEN_COMFY_PR = ************
bunx comfy-pr [...GITHUB_REPO_URLS]
A demo .env should be sth like:
# your github token
GH_TOKEN=ghp_WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW
# the pr source organization/ leave it blank to use yourself's account.
FORK_OWNER="ComfyNodePRs"
# PR prefix
FORK_PREFIX="PR-"
GO https://github.com/settings/tokens?type=beta to get an Github Access key
Check 3 permissions for all of your repositories
And save your GH_TOKEN into .env file
Must provide to push code automaticaly, btw prob. you've already setup.
Run ssh-keygen, got id_rsa.pub, Then add into here https://github.com/settings/keys
Ways to run this script
After configured your .env file, run docker compose build and up.
git clone https://github.com/drip-art/Comfy-Registry-PR
cd Comfy-Registry-PR
docker compose build
docker compose up
docker run --rm -it \
-v $HOME/.ssh:/root/.ssh:ro \
-e GH_TOKEN=ghp_WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW \
-e REPO=https://github.com/snomiao/ComfyNode-Registry-test \
snomiao/comfy-registry-pr
git clone https://github.com/drip-art/Comfy-Registry-PR
# setup comfy-cli environment
cd Comfy-Registry-PR
python3 -m venv .venv
chmod +x ./.venv/bin/*
source ./.venv/bin/activate
pip3 install comfy-cli
# setup bun for js-script
curl -fsSL https://bun.sh/install | bash
bun i
# and
bun src/cli.ts [REPO_PATH_NEED_TO_PR]
# for example
bun src/cli.ts https://github.com/snomiao/ComfyNode-Registry-test
git clone https://github.com/drip-art/Comfy-Registry-PR
@REM setup comfy-cli environment
cd Comfy-Registry-PR
python3 -m venv .venv
.\.venv\Scripts\activate
pip3 install comfy-cli
@REM run with tsx
npx -y cross-env REPO=https://github.com/snomiao/ComfyNode-Registry-test npx -y tsx src/cli.ts
Don't change it unless you know what you are doing.
ENV FORK_OWNER=drip-art
ENV FORK_PREFIX=PR-
# Unset it into current authorized user's name and email (from your github api token).
ENV GIT_USEREMAIL=comfy-ci@drip.art
ENV GIT_USERNAME=comfy-ci
# Create comfy pr dir and go into it
mkdir comfy-pr
cd comfy-pr
# Prepare code and environments
git clone https://github.com/drip-art/Comfy-Registry-PR .
# Prepare bun
# go here - [Installation \| Bun Docs]( https://bun.sh/docs/installation )
# Install project
bun i
# Prepare bun
bun i
Setup envs in the usages section above (plz check bun src/cli.ts runnable first)
Run mongodb with docker compose
docker compose -f docker-compose.mongodb.yml up
services:
mongdb:
restart: always
image: mongo
ports: ["27017:27017"]
volumes: [./data/mongodb:/data/db]
And fill URI into env
MONGODB_URI=mongodb://localhost:27017
# To initialize your database, run:
bun src/index.ts
# To start develop in any of other scripts:
# Feel free to run any scripts in src/, they are safe to re-run and stop in any time.
bun src/THAT_FILE_YOU_WANT_TO_RUN.ts
# To check if you didn't break anything?
bun test --watch
Make .env.development.local as
MONGODB_URI_INSPECT_HAOHAO={{that readonly db link sno gave you}}
MONGODB_URI=$MONGODB_URI_INSPECT_HAOHAO
And inspect db with script, e.g. src/checkPRsFailures.ts
FAQs
Make PRs that publishes ComfyUI Custom Nodes to [ComfyUI Registry]( https://www.comfyregistry.org/ ).
The npm package comfy-pr receives a total of 2 weekly downloads. As such, comfy-pr popularity was classified as not popular.
We found that comfy-pr demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.