From aea1e3d45248b0fddd72b3785112809e6a640e31 Mon Sep 17 00:00:00 2001
From: soonnae <ohjeongmin9@gmail.com>
Date: Mon, 29 Dec 2025 17:30:28 +0900
Subject: [PATCH 1/3] [ AutoFiC ] Create package.json and CI workflow

---
 .github/workflows/pr_notify.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 .github/workflows/pr_notify.yml

diff --git a/.github/workflows/pr_notify.yml b/.github/workflows/pr_notify.yml
new file mode 100644
index 00000000..2b34036d
--- /dev/null
+++ b/.github/workflows/pr_notify.yml
@@ -0,0 +1,20 @@
+name: PR Notifier
+
+on:
+  pull_request:
+    types: [opened, reopened, closed]
+
+jobs:
+  notify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify Discord
+        env:
+          DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
+        run: |
+          curl -H "Content-Type: application/json"           -d '{"content": "🔔 Pull Request [${{ github.event.pull_request.title }}](${{ github.event.pull_request.html_url }}) by ${{ github.event.pull_request.user.login }} - ${{ github.event.action }}"}'           $DISCORD_WEBHOOK_URL
+      - name: Notify Slack
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+        run: |
+          curl -H "Content-Type: application/json"           -d '{"text": ":bell: Pull Request <${{ github.event.pull_request.html_url }}|${{ github.event.pull_request.title }}> by ${{ github.event.pull_request.user.login }} - ${{ github.event.action }}"}'           $SLACK_WEBHOOK_URL

From 67c5cc95b6d2d72ec68a1e2b6af633c2514980eb Mon Sep 17 00:00:00 2001
From: soonnae <ohjeongmin9@gmail.com>
Date: Mon, 29 Dec 2025 17:30:30 +0900
Subject: [PATCH 2/3] [ AutoFiC ] 1 malicious code detected!!

---
 dagshub/storage/rclone.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/dagshub/storage/rclone.py b/dagshub/storage/rclone.py
index 2dfee24c..34989bfa 100644
--- a/dagshub/storage/rclone.py
+++ b/dagshub/storage/rclone.py
@@ -55,7 +55,9 @@ def check_and_provide_install_script(quiet=False):
                 for package, cmd in missing_packages:
                     log_message(f"Installing {package}...")
                     try:
-                        subprocess.run(cmd, shell=True, check=True)
+                        # Split the command into a list of arguments
+                        cmd_list = cmd.split()
+                        subprocess.run(cmd_list, check=True)
                         log_message(f"{package} installed successfully.")
                     except subprocess.CalledProcessError as e:
                         logger.error(f"Failed to install {package}: {e}")

From aeb3ab8c5c249eb4e86af1955c598e0d4b34d846 Mon Sep 17 00:00:00 2001
From: soonnae <ohjeongmin9@gmail.com>
Date: Mon, 29 Dec 2025 17:33:59 +0900
Subject: [PATCH 3/3] chore: remove CI workflow before upstream PR

---
 .github/workflows/pr_notify.yml | 20 --------------------
 1 file changed, 20 deletions(-)
 delete mode 100644 .github/workflows/pr_notify.yml

diff --git a/.github/workflows/pr_notify.yml b/.github/workflows/pr_notify.yml
deleted file mode 100644
index 2b34036d..00000000
--- a/.github/workflows/pr_notify.yml
+++ /dev/null
@@ -1,20 +0,0 @@
-name: PR Notifier
-
-on:
-  pull_request:
-    types: [opened, reopened, closed]
-
-jobs:
-  notify:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Notify Discord
-        env:
-          DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
-        run: |
-          curl -H "Content-Type: application/json"           -d '{"content": "🔔 Pull Request [${{ github.event.pull_request.title }}](${{ github.event.pull_request.html_url }}) by ${{ github.event.pull_request.user.login }} - ${{ github.event.action }}"}'           $DISCORD_WEBHOOK_URL
-      - name: Notify Slack
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-        run: |
-          curl -H "Content-Type: application/json"           -d '{"text": ":bell: Pull Request <${{ github.event.pull_request.html_url }}|${{ github.event.pull_request.title }}> by ${{ github.event.pull_request.user.login }} - ${{ github.event.action }}"}'           $SLACK_WEBHOOK_URL