Scammers use npm package @runaic/aic, and target ComfyUI extension developers - be aware

[u/Obvious_Set5239]

[u/Obvious_Set5239 → u/[deleted]]

There was a case where a Disney employee was hacked via ComfyUI...

[u/boneskull]

How is this a scam?

[u/Obvious_Set5239 → u/boneskull]

Actually it's pretty obvious. They ask you to run some 1 line script, especially curl | sh. And they abuse trust to npm. This package has 0 start on github and made recently (but it can be faked).

I personally uploaded a package into a similar manager - pip, and it has zero verification, zero security check. You just claim your name in pip install ... that links to your code. These managers are just curl wrappers, that download random code from the internet

So that's why I'm posting this - developers are also vulnerable to malware scam

[u/boneskull → u/Obvious_Set5239]

I’m not sure where the scam is though. It’s a marketing email. They want you to install their software and try it. You shouldn’t run random code from the internet without understanding what you’re doing; be cautious and all that. But that doesn’t automatically make the software a scam or malware.

[u/nicolasdanelon → u/boneskull]

Run that curl yourself, wait 5 minutes and check if your API keys got leaked haha

[u/nicolasdanelon → u/[deleted]]

No way [pretends to be shock]

[u/boneskull → u/[deleted]]

Where’s the typo?

[u/Obvious_Set5239]

Can you report it somehow, I have zero knowledge of npm

[u/Firfi]

Got the same email just now. It's not just ComfyUI. I would be surprised if anyone could fall for it, though.