Malicious ComfyUI-Manager node install via pip git+ or git clone spawned by python

Georgios Maragos@Gmarak

•updated Jul 18, 2026•0•0•6

Detects instances of 'pip' or 'git' being executed by a Python process to clone or install packages from external sources. This behavior is commonly used to install malicious or untrusted custom nodes within a ComfyUI environment, potentially facilitating initial access or code execution.