diff --git a/registry/standards.mdx b/registry/standards.mdx index 421b71c..7b43e1b 100644 --- a/registry/standards.mdx +++ b/registry/standards.mdx @@ -71,3 +71,15 @@ Code obfuscation is prohibited in custom nodes. Obfuscated code: - Impossible to review and likely to be malicious +#### Use of `requests` or direct downloading to populate Python code or libraries for use in modules +The use of the `requests` library to download Python code from other repositories is not permitted. + +#### Policy +Runtime package and library installation through `requests` calls, similar to `subprocess` calls to run `pip` installs and such, is not permitted. + +#### Reasoning +The use of `requests` and other downloading libraries to directly download files can lead to injection of bad URLs via memory manipulation or by hijacked URLs. This leads to situations where insecure and unvetted code are downloaded and executed in your environment, including: + - Keyloggers + - Ransomware + - Data exfiltration and theft through unaudited code. + - Other malicious code execution