Maybe ComfyUI_LLMVISION[1] malicious extension then (my speculation based purely on the date of hack).

Edit: yes, probably it was ComfyUI_LLMVISION[2]

[1] https://www.reddit.com/r/comfyui/comments/1dbls5n/psa_if_you...

[2] https://news.ycombinator.com/item?id=40960666