top of page
Search

Is ComfyUI Safe? A Custom Node Pack Sent Its Terminal Password to a Remote Server

Writer: Daniel Carr, MSW
Daniel Carr, MSW
Oct 25
8 min read

ComfyUI is one of the largest AI projects on GitHub, with more than 142,000 stars, nearly 17,000 forks, and a current Windows release that has already been downloaded well over 100,000 times. A recent security investigation now raises a much less comfortable question about the enormous ecosystem of custom nodes that can be installed around it. One Windows user installed a package called champdev-comfyui-nodes through ComfyUI Manager and later discovered a remote access trojan, a cryptocurrency miner, dozens of hidden Python processes, and persistent command and control connections on the machine.


The evidence does not establish that ComfyUI itself installed the malware, but subsequent inspection found that the custom node package contained capabilities and telemetry behavior that deserve considerably more attention than an ordinary plugin.


The security report was opened on September 28, 2026 and remains active on GitHub. A ComfyUI maintainer initially found no evidence that the package directly installed the malware, although the maintainer described its telemetry as suspicious enough that the project was considering banning it. Further analysis posted on October 19 identified something more concrete: version 0.6.1 of the package appears to send the password protecting its terminal and file manager to a remote telemetry server by default. That creates a much clearer security concern even without proving who installed the miner or remote access trojan.


Is ComfyUI Safe

What happened to the affected ComfyUI computer


According to the GitHub report, the user installed champdev-comfyui-nodes version 0.5.2 through the Comfy Registry on September 20. Roughly fourteen minutes later, an unsigned 18 MB mining program appeared in the shared ComfyUI output directory and connected to a cryptocurrency mining pool. Over the following days, additional files appeared inside the custom node directories, including several fake node packages containing a prestartup_script.py file. By September 29, investigators reported roughly 60 hidden Python processes and two active WebSocket connections to remote command and control infrastructure.


The decoded remote access payload described in the report was not a trivial downloader. It reportedly supported arbitrary Python execution, shell commands, process launching, screenshots, directory listing, and file transfer. The malware could also refresh its command and control addresses from several external web services, giving the operator alternative communication paths if one server disappeared. A separate cryptominer was still running during incident response. The compromise had therefore progressed far beyond a browser annoyance or unwanted analytics request.



The custom node package itself was not proven to contain the RAT


This distinction is crucial to understanding the incident. The reporter compared the files originally distributed through the Comfy Registry with the files installed on the victim machine and found that the remote access loader was not present in the Registry package. The extra prestartup_script.py files appeared afterward, which means the public evidence does not prove that the published package deliberately dropped the RAT during installation. A ComfyUI maintainer examined the report and similarly said the node did not appear to actively install malware.


That finding prevents a responsible review from calling champdev-comfyui-nodes a confirmed trojan installer. The machine may instead have been compromised through capabilities exposed by the package itself, through another service on the machine, or through some other attack path that has not been established publicly. The security report explicitly leaves both direct installation and subsequent exploitation as open possibilities. What investigators found inside the legitimate package is still concerning on its own.



The node package includes a terminal and file manager


champdev-comfyui-nodes contains a terminal feature capable of exposing a shell through ComfyUI and a file manager capable of reading and writing files. Those features can be legitimate tools when they are deliberately installed and protected, but they dramatically change the consequences of exposing ComfyUI to another network. A normal image generation node manipulates tensors, prompts, or files inside a narrow workflow, while a terminal node can potentially execute commands with the permissions of the account running ComfyUI. A file manager likewise expands the reachable surface from image workflows into the host filesystem.


This is where the architecture becomes dangerous if ComfyUI is reachable from the public Internet without independent authentication. The package effectively adds remote administration capabilities inside an application that many people treat primarily as an image generation interface. The maintainer responding to the issue specifically noted that the node provided an easy avenue for compromise if the ComfyUI instance had been exposed publicly. In that configuration, the difference between an AI workflow editor and a remote shell can become surprisingly thin.



Then researchers found the terminal password inside the telemetry


The October 19 follow up gives the incident a much stronger security angle. A reviewer traced the package's telemetry implementation and reported that version 0.6.1 sends public and private IP information, hardware details, GPU information, and a value called token to https://comfy-nodes-telemetry.champdev.in/ingest. The same analysis found that this token comes from the package's password system and functions as the effective password used to unlock its terminal and file manager. Even a password explicitly supplied through CHAMPDEV_AUTH_PASSWORD reportedly reaches the telemetry payload in decrypted form.


Sending ordinary anonymous usage statistics would be one debate. Sending the credential protecting a remote terminal is a fundamentally different trust decision. If the analysis is correct, the telemetry receiver can receive the very credential intended to prevent unauthorized use of the package's most powerful functions. The reviewer carefully described remote exploitation as an inference rather than claiming it had been observed, but the credential exposure itself is supported by the connected implementation paths described in the report.



This is not evidence that ComfyUI itself is malware


ComfyUI Core is not the package accused in this report. The security issue concerns a separately installed custom node distributed through the surrounding ecosystem, and the evidence does not show that an official ComfyUI release contains the RAT or cryptominer found on the affected computer. ComfyUI's extensibility is one of the reasons it became so popular, since custom nodes can add new models, controls, utilities, processing techniques, and entire workflow systems. The same extensibility also means installing a node can grant Python code substantial access to the machine running it.


A useful comparison is not a browser extension but a package installed into an active Python application. Custom nodes can execute code, install dependencies, register server routes, and integrate deeply with ComfyUI. The security boundary therefore depends partly on which extensions a user chooses to install. Treating every Registry entry as equivalent to a harmless visual preset would misunderstand what those packages are technically capable of doing.



ComfyUI being local does not automatically make it safe


ComfyUI normally makes the most sense as a local application, and the project's current documentation emphasizes local execution. Problems become more serious when users bind the server to an externally reachable interface or expose it through a poorly protected reverse proxy. A machine visible to the Internet can receive requests from people who were never intended to operate its workflows, and a custom node that exposes shell or file management functions can magnify that exposure dramatically. The same software running only on a trusted local interface has a substantially different attack surface.


This distinction is especially relevant because ComfyUI is increasingly used as infrastructure rather than merely as a desktop toy. People run it on dedicated GPU servers, cloud machines, home lab systems, and shared workstations where expensive hardware makes remote access attractive. Those environments frequently have broader network connectivity and more persistent uptime than an ordinary desktop session. A security mistake on such a host can turn an image generation server into an appealing target for cryptomining because the machine already contains exactly the GPU resources miners want.



The cryptominer story has appeared around ComfyUI before


The September report is not the first time malicious activity has intersected with the ComfyUI extension ecosystem. The issue references an earlier malicious node incident involving Upscaler_4K, which resulted in a public postmortem and takedown. Security researchers have also documented Internet exposed ComfyUI installations being targeted for remote execution and cryptocurrency mining. Those earlier events give the new report context without proving that every incident has the same cause.


The pattern is understandable from an attacker's perspective. ComfyUI users frequently have modern NVIDIA GPUs, Python environments capable of executing downloaded code, and a culture of installing community extensions to obtain the newest models and workflow features. That combination creates unusually valuable targets when access controls are weak. A custom node ecosystem therefore needs security expectations closer to a software package repository than to a gallery of downloadable themes.



Is ComfyUI safe to install?


The official ComfyUI project itself does not emerge from this report as malware, and there is no evidence here that downloading the current official release automatically compromises a computer. ComfyUI 0.42.1 is the current core release, published on October 19, and the official NVIDIA Windows portable build alone has accumulated more than 135,000 downloads. The more defensible conclusion is that ComfyUI can be used safely while its custom node ecosystem deserves substantially more caution than many users may realize. Installing arbitrary nodes expands the trusted computing base of the application every time another package is added.


Users who stick to official releases, avoid unknown custom nodes, and keep the server inaccessible from untrusted networks remove much of the attack path described in this incident. Anyone who has installed champdev-comfyui-nodes should take the GitHub report seriously, particularly if the machine was reachable from outside a trusted network. Removing the package alone may not be sufficient if a host has already been compromised, since the reported RAT established persistence through additional files and fake node directories. The report also notes that restarting ComfyUI is necessary after disabling or removing the node so its registered routes are no longer loaded.



The biggest ComfyUI security risk may be how powerful plugins are allowed to become


The larger lesson is architectural rather than specific to one publisher. ComfyUI custom nodes can be extraordinarily useful precisely because they are not trapped inside a narrow sandbox. That freedom lets developers integrate new inference systems, install Python dependencies, manipulate files, create server endpoints, and build tools long before comparable functionality arrives in the core application. It also means a poorly designed or malicious extension can inherit far more authority than its name in a node menu suggests.

The champdev-comfyui-nodes report provides an unusually concrete example. A package presented as a collection of ComfyUI functionality included remote terminal and file management capabilities, collected extensive system telemetry, and appears to have transmitted the credential protecting those administrative functions. A victim machine running the package was also compromised by a miner and a sophisticated RAT, although the available evidence does not prove which route produced that compromise. ComfyUI remains an exceptional AI creation platform, but its plugin ecosystem should be treated as executable software rather than decoration.



Download ComfyUI 0.42.1 for Windows


ComfyUI provides official portable Windows builds for NVIDIA, AMD, and Intel hardware, while the project recommends its newer desktop application for most ordinary users. The current NVIDIA portable build is ComfyUI 0.42.1 and is distributed directly through the official GitHub release. Users installing custom nodes afterward should remember that those extensions are separate software and are not automatically covered by the trust placed in the official package.




Download ComfyUI for Mac


The ComfyUI project recommends its official desktop application for Mac users rather than a portable GitHub package. The desktop download supports macOS and uses the stable ComfyUI Core release underneath the application. Users should still evaluate custom nodes separately, since installing a community extension changes what code is allowed to run inside the ComfyUI environment.


Official ComfyUI Mac download: https://www.comfy.org/download



Download ComfyUI for Linux


Linux remains officially supported through the manual installation process and comfy-cli. The project recommends current Python and PyTorch versions appropriate for the installed GPU, with separate guidance for NVIDIA, AMD, Intel, and other accelerators. The official repository contains the current installation instructions and should be preferred over repackaged downloads from unrelated websites.


Official ComfyUI Linux installation: https://github.com/Comfy-Org/ComfyUI



ComfyUI GitHub Security Report


The security investigation remains open as ComfyUI issue #16631, and its public discussion includes both the original compromise timeline and the later analysis of the terminal credential appearing in telemetry. The issue currently stops short of proving that the custom node itself installed the remote access trojan or miner, which is an essential distinction when judging the incident. It nevertheless documents enough verified behavior around the package to make the security implications worth understanding before installing powerful community nodes.



Comments

bottom of page