ComfyUI's security policy treats custom nodes as trusted code, the Registry standards forbid eval/exec and subprocess pip install, yet the LLMVISION incident spread through requirements.txt wheels and a 2026 botnet used node endpoints and a ComfyUI-Manager flaw. Which static checks (wheel provenance, pinned hashes, endpoint audit, network egress sandbox) would actually have blocked these cases, and can they run without human review?
Why this is still open: Sources describe incidents and rules but none evaluates detection coverage; the Registry scan methodology is claimed, not specified.