Manual review request: evolink-nodes 1.0.3 / 1.1.0 / 2.0.0 flagged by the same 2 YARA rules previously batch-approved for 1.0.x

[deeplearning-goethe]

Node info

• Registry node ID: evolink-nodes (publisher: evolink)
• Repository: https://github.com/deeplearning-goethe/comfyui-evolink
• Flagged versions: 1.0.3, 1.1.0, 2.0.0
• Currently served latest: 1.0.2 (Active) — users get an outdated 2-node version instead of the current 56-node release.

What the scan flagged (from include_status_reason=true)

I pulled the scan reports via GET /nodes/evolink-nodes/versions?include_status_reason=true. All findings are severity info:

Common to 1.0.3 / 1.1.0 / 2.0.0 — identical to the findings on 1.0.0 / 1.0.1 / 1.0.2, which were already batch-approved by admin (batch 232286de):

1. $env_read2 → os.environ.get( in nodes/config.py (reads the EVOLINK_API_KEY env var — one of the documented ways users provide their API key)
2. $http1 → requests.get( in nodes/task_utils.py:21 (downloads the generated image/video result from the EvoLink API)

2.0.0 only — two extra hits from dev-time scripts that were accidentally packaged:

3. $http2 → urllib.request.urlopen( in tools/extract_api_params.py
4. $importlib_direct → importlib.import_module( in tools/test_registry.py

Context

This is the official API client for EvoLink (api.evolink.ai), an AI image/video generation service. Pure API node pack: no eval/exec, no subprocess, no runtime pip installs, no obfuscation. Findings 1–2 are the unavoidable core of any API node (env-var key + result download) and were already reviewed and approved on 1.0.0 / 1.0.1 / 1.0.2.

For findings 3–4 we have already shipped a fix: .comfyignore now excludes tools/ from the package (deeplearning-goethe/comfyui-evolink@dec0656), and we are publishing 2.0.1 with that packaging fix — it is back to the same 2-finding baseline as the approved 1.0.x versions.

Request

Could you please review and approve the flagged versions — at minimum 2.0.1 (or 2.0.0), so latest serves the current release? Happy to adjust anything needed for compliance. Thanks!