Skip to content

Verification Request: homebridge-nest-accfactory-plus #1309

Open
Open
Verification Request: homebridge-nest-accfactory-plus#1309
Labels
awaiting-changesuse after review has started - awaiting user to make changes to pluginrequest-verification

Description

@pponce
pponce
opened on Oct 27, 2026

Plugin Name

homebridge-nest-accfactory-plus

Link To GitHub Repo

https://github.com/pponce/homebridge-nest-accfactory-plus

Plugin Icon (Optional)

I’m requesting separate verified status for homebridge-nest-accfactory-plus because it preserves the legacy Google refresh-token authentication method for users who still have working credentials.
Plugin icon:
Image

The plugin does not offer the same nor less functionality than that of any existing verified plugin.

🟠 No (please explain in the more information box at the end)

The plugin successfully installs and does not start unless it is configured.

🟢 Yes

The plugin does not require the user to run Homebridge in a TTY or with non-standard startup parameters, even for initial configuration.

🟢 Yes

The plugin does not contain any analytics or calls that enable you to track the user.

🟢 Yes

If the plugin needs to write files to disk (cache, keys, etc.), it stores them inside the Homebridge storage directory.

🟢 Yes

The plugin does not throw unhandled exceptions, the plugin must catch and log its own errors.

🟢 Yes

More Information

I asked the upstream maintainer whether they would include this authentication path, but they preferred not to support it. This fork retains that option while following upstream updates. It does not enable users to generate new legacy credentials.
I’d like users in the same situation as me to have access to this alternative, with the added confidence that comes from Homebridge’s review and verification process. If these are not good enough reason for requesting verified status just let me know.

Activity

  1. pponce
    added
    pendingthe label given to a new verification/icon request
    request-verification
    on Oct 27, 2026

  2. pponce commented on Oct 27, 2026

    @pponce
    pponce
    on Oct 27, 2026
    Author

    /check

  3. github-actions commented on Oct 27, 2026

    @github-actions
    github-actionsBot
    on Oct 27, 2026 – with GitHub Actions
    Contributor

    🔴 Failed Checks

    • Security: Runtime - suspicious file/command access detected in scenario "platform only": /workspace/test-area/node_modules/@peculiar/asn1-x509/build/cjs/extensions/private_key_usage_period.js, /workspace/test-area/node_modules/@peculiar/asn1-ecc/build/cjs/ec_private_key.js, /workspace/test-area/node_modules/@peculiar/asn1-rsa/build/cjs/rsa_private_key.js, /workspace/test-area/node_modules/@peculiar/asn1-pkcs8/build/cjs/encrypted_private_key_info.js, /workspace/test-area/node_modules/@peculiar/asn1-pkcs8/build/cjs/private_key_info.js
    • Security: Runtime - suspicious file/command access detected in scenario "full config": /workspace/test-area/node_modules/@peculiar/asn1-x509/build/cjs/extensions/private_key_usage_period.js, /workspace/test-area/node_modules/@peculiar/asn1-ecc/build/cjs/ec_private_key.js, /workspace/test-area/node_modules/@peculiar/asn1-rsa/build/cjs/rsa_private_key.js, /workspace/test-area/node_modules/@peculiar/asn1-pkcs8/build/cjs/encrypted_private_key_info.js, /workspace/test-area/node_modules/@peculiar/asn1-pkcs8/build/cjs/private_key_info.js
    • GitHub Repo: should have issues enabled

    🟢 Passed Checks

    • Installation: successfully installed
    • Package JSON: homepage exists
    • Package JSON: bugs.url exists and seems a valid URL
    • Package JSON: keywords exist and contain 'homebridge-plugin'
    • Package JSON: keywords declare the supported transports ('supports-hap' and/or 'supports-matter')
    • Package JSON: 'preinstall' in scripts is not present
    • Package JSON: 'install' in scripts is not present
    • Package JSON: 'postinstall' in scripts is not present
    • Package JSON: engines.node property is compatible with Node 22
    • Package JSON: engines.node property is compatible with Node 24
    • Package JSON: engines.homebridge property is compatible with Homebridge 2.4.0
    • Package JSON: initializer function found
    • NPM Package: has not been deprecated
    • GitHub Repo: version in package.json (v0.4.4) matches NPM version (v0.4.4)
    • Config Schema JSON: exists and is valid JSON
    • Config Schema JSON: contains valid JSON Schema
    • Config Schema JSON: schema has valid type property
    • Config Schema JSON: schema has valid properties for object type
    • Config Schema JSON: contains a valid pluginAlias
    • Config Schema JSON: pluginAlias matches the platform/accessory registered in code
    • Config Schema JSON: the pluginType is set to 'platform'
    • Config Schema JSON: contains a name schema property
    • Dependencies: homebridge is not declared as a runtime/peer/bundled dependency
    • Dependencies: hap-nodejs is not declared as a runtime/peer/bundled dependency
    • Security: no known vulnerabilities in dependencies
    • Security: code patterns flagged for manual review
    • Security: no privilege escalation attempts detected
    • Runtime: homebridge installed successfully
    • Runtime: no config - homebridge should start without plugin configuration and plugin should not load
    • Runtime: platform only - plugin should start with just platform property
    • Runtime: full config - plugin should start with comprehensive configuration
    • Runtime: network resilience - plugin should handle network failures without crashing
    • Runtime: plugin shuts down cleanly within 12s of SIGTERM
    • Runtime: plugin restarts cleanly without port conflicts
    • GitHub Repo: repository is public
    • GitHub Repo: repository is not archived
    • GitHub Repo: contains releases

    🔍 For Manual Review

    The following items were detected and require manual review. We understand that these items may be false positives.

    • Security: accesses environment files in dist/plugins/camera/ffmpeg.js

    ℹ️ Check Details

    • These checks were run against v0.4.4 of the plugin.
    • Link to the run workflow: visit →.
    • External HTTP requests detected:
      • 📡 test-api-key-12345
        Methods: get | Count: 3 | Scenarios: full config, network resilience

    📋 Next Steps

    • Once you have fixed these failures, comment /check on this issue to run the checks again — your request will not move forward until the checks are re-run.
    • If updating your package.json and config.schema.json files, don't forget to publish a new version to NPM.
    • Remember this is an automatic script: if you think something has been marked as a failure in error, let us know with a reply.
    • Feel free to ask any questions you have by replying to this issue.
  4. github-actions
    added
    awaiting-changesuse after review has started - awaiting user to make changes to plugin
    and removed
    pendingthe label given to a new verification/icon request
    on Oct 27, 2026

  5. github-actions commented on Oct 27, 2026

    @github-actions
    github-actionsBot
    on Oct 27, 2026 – with GitHub Actions
    Contributor

    🔴 Failed Checks

    • Security: Runtime - suspicious file/command access detected in scenario "platform only": /workspace/test-area/node_modules/@peculiar/asn1-x509/build/cjs/extensions/private_key_usage_period.js, /workspace/test-area/node_modules/@peculiar/asn1-ecc/build/cjs/ec_private_key.js, /workspace/test-area/node_modules/@peculiar/asn1-rsa/build/cjs/rsa_private_key.js, /workspace/test-area/node_modules/@peculiar/asn1-pkcs8/build/cjs/encrypted_private_key_info.js, /workspace/test-area/node_modules/@peculiar/asn1-pkcs8/build/cjs/private_key_info.js
    • Security: Runtime - suspicious file/command access detected in scenario "full config": /workspace/test-area/node_modules/@peculiar/asn1-x509/build/cjs/extensions/private_key_usage_period.js, /workspace/test-area/node_modules/@peculiar/asn1-ecc/build/cjs/ec_private_key.js, /workspace/test-area/node_modules/@peculiar/asn1-rsa/build/cjs/rsa_private_key.js, /workspace/test-area/node_modules/@peculiar/asn1-pkcs8/build/cjs/encrypted_private_key_info.js, /workspace/test-area/node_modules/@peculiar/asn1-pkcs8/build/cjs/private_key_info.js
    • GitHub Repo: should have issues enabled

    🟢 Passed Checks

    • Installation: successfully installed
    • Package JSON: homepage exists
    • Package JSON: bugs.url exists and seems a valid URL
    • Package JSON: keywords exist and contain 'homebridge-plugin'
    • Package JSON: keywords declare the supported transports ('supports-hap' and/or 'supports-matter')
    • Package JSON: 'preinstall' in scripts is not present
    • Package JSON: 'install' in scripts is not present
    • Package JSON: 'postinstall' in scripts is not present
    • Package JSON: engines.node property is compatible with Node 22
    • Package JSON: engines.node property is compatible with Node 24
    • Package JSON: engines.homebridge property is compatible with Homebridge 2.4.0
    • Package JSON: initializer function found
    • NPM Package: has not been deprecated
    • GitHub Repo: version in package.json (v0.4.4) matches NPM version (v0.4.4)
    • Config Schema JSON: exists and is valid JSON
    • Config Schema JSON: contains valid JSON Schema
    • Config Schema JSON: schema has valid type property
    • Config Schema JSON: schema has valid properties for object type
    • Config Schema JSON: contains a valid pluginAlias
    • Config Schema JSON: pluginAlias matches the platform/accessory registered in code
    • Config Schema JSON: the pluginType is set to 'platform'
    • Config Schema JSON: contains a name schema property
    • Dependencies: homebridge is not declared as a runtime/peer/bundled dependency
    • Dependencies: hap-nodejs is not declared as a runtime/peer/bundled dependency
    • Security: no known vulnerabilities in dependencies
    • Security: code patterns flagged for manual review
    • Security: no privilege escalation attempts detected
    • Runtime: homebridge installed successfully
    • Runtime: no config - homebridge should start without plugin configuration and plugin should not load
    • Runtime: platform only - plugin should start with just platform property
    • Runtime: full config - plugin should start with comprehensive configuration
    • Runtime: network resilience - plugin should handle network failures without crashing
    • Runtime: plugin shuts down cleanly within 12s of SIGTERM
    • Runtime: plugin restarts cleanly without port conflicts
    • GitHub Repo: repository is public
    • GitHub Repo: repository is not archived
    • GitHub Repo: contains releases

    🔍 For Manual Review

    The following items were detected and require manual review. We understand that these items may be false positives.

    • Security: accesses environment files in dist/plugins/camera/ffmpeg.js

    ℹ️ Check Details

    • These checks were run against v0.4.4 of the plugin.
    • Link to the run workflow: visit →.
    • External HTTP requests detected:
      • 📡 test-api-key-12345
        Methods: get | Count: 3 | Scenarios: full config, network resilience

    📋 Next Steps

    • Once you have fixed these failures, comment /check on this issue to run the checks again — your request will not move forward until the checks are re-run.
    • If updating your package.json and config.schema.json files, don't forget to publish a new version to NPM.
    • Remember this is an automatic script: if you think something has been marked as a failure in error, let us know with a reply.
    • Feel free to ask any questions you have by replying to this issue.

  6. pponce commented on Oct 27, 2026

    @pponce
    pponce
    on Oct 27, 2026
    Author

    Issues are now enabled for the repository.

    @bwp91 Tagging you since you reviewed some of my other requests for verification. Could you manually review the security findings? The flagged @peculiar/asn1-* paths are JavaScript dependency modules loaded through werift, which provides camera WebRTC support. Their filenames contain private_key; they are not user private-key files.

    The environment-file warning in dist/plugins/camera/ffmpeg.js also appears to be a false positive: the checker’s /.env/ pattern matches process.env and process.env.PATH, used to pass the process environment to FFmpeg and locate its executable.

    Please let me know if you need any additional information.

  7. pponce commented on Oct 27, 2026

    @pponce
    pponce
    on Oct 27, 2026
    Author

    /check

  8. github-actions
    added
    pendingthe label given to a new verification/icon request
    and removed
    awaiting-changesuse after review has started - awaiting user to make changes to plugin
    on Oct 27, 2026

  9. github-actions commented on Oct 27, 2026

    @github-actions
    github-actionsBot
    on Oct 27, 2026 – with GitHub Actions
    Contributor

    🔴 Failed Checks

    • Security: Runtime - suspicious file/command access detected in scenario "platform only": /workspace/test-area/node_modules/@peculiar/asn1-x509/build/cjs/extensions/private_key_usage_period.js, /workspace/test-area/node_modules/@peculiar/asn1-ecc/build/cjs/ec_private_key.js, /workspace/test-area/node_modules/@peculiar/asn1-rsa/build/cjs/rsa_private_key.js, /workspace/test-area/node_modules/@peculiar/asn1-pkcs8/build/cjs/encrypted_private_key_info.js, /workspace/test-area/node_modules/@peculiar/asn1-pkcs8/build/cjs/private_key_info.js
    • Security: Runtime - suspicious file/command access detected in scenario "full config": /workspace/test-area/node_modules/@peculiar/asn1-x509/build/cjs/extensions/private_key_usage_period.js, /workspace/test-area/node_modules/@peculiar/asn1-ecc/build/cjs/ec_private_key.js, /workspace/test-area/node_modules/@peculiar/asn1-rsa/build/cjs/rsa_private_key.js, /workspace/test-area/node_modules/@peculiar/asn1-pkcs8/build/cjs/encrypted_private_key_info.js, /workspace/test-area/node_modules/@peculiar/asn1-pkcs8/build/cjs/private_key_info.js

    🟢 Passed Checks

    • Installation: successfully installed
    • Package JSON: homepage exists
    • Package JSON: bugs.url exists and seems a valid URL
    • Package JSON: keywords exist and contain 'homebridge-plugin'
    • Package JSON: keywords declare the supported transports ('supports-hap' and/or 'supports-matter')
    • Package JSON: 'preinstall' in scripts is not present
    • Package JSON: 'install' in scripts is not present
    • Package JSON: 'postinstall' in scripts is not present
    • Package JSON: engines.node property is compatible with Node 22
    • Package JSON: engines.node property is compatible with Node 24
    • Package JSON: engines.homebridge property is compatible with Homebridge 2.4.0
    • Package JSON: initializer function found
    • NPM Package: has not been deprecated
    • GitHub Repo: version in package.json (v0.4.4) matches NPM version (v0.4.4)
    • Config Schema JSON: exists and is valid JSON
    • Config Schema JSON: contains valid JSON Schema
    • Config Schema JSON: schema has valid type property
    • Config Schema JSON: schema has valid properties for object type
    • Config Schema JSON: contains a valid pluginAlias
    • Config Schema JSON: pluginAlias matches the platform/accessory registered in code
    • Config Schema JSON: the pluginType is set to 'platform'
    • Config Schema JSON: contains a name schema property
    • Dependencies: homebridge is not declared as a runtime/peer/bundled dependency
    • Dependencies: hap-nodejs is not declared as a runtime/peer/bundled dependency
    • Security: no known vulnerabilities in dependencies
    • Security: code patterns flagged for manual review
    • Security: no privilege escalation attempts detected
    • Runtime: homebridge installed successfully
    • Runtime: no config - homebridge should start without plugin configuration and plugin should not load
    • Runtime: platform only - plugin should start with just platform property
    • Runtime: full config - plugin should start with comprehensive configuration
    • Runtime: network resilience - plugin should handle network failures without crashing
    • Runtime: plugin shuts down cleanly within 12s of SIGTERM
    • Runtime: plugin restarts cleanly without port conflicts
    • GitHub Repo: repository is public
    • GitHub Repo: repository is not archived
    • GitHub Repo: issues are enabled
    • GitHub Repo: contains releases

    🔍 For Manual Review

    The following items were detected and require manual review. We understand that these items may be false positives.

    • Security: accesses environment files in dist/plugins/camera/ffmpeg.js

    ℹ️ Check Details

    • These checks were run against v0.4.4 of the plugin.
    • Link to the run workflow: visit →.
    • External HTTP requests detected:
      • 📡 test-api-key-12345
        Methods: get | Count: 3 | Scenarios: full config, network resilience

    📋 Next Steps

    • Once you have fixed these failures, comment /check on this issue to run the checks again — your request will not move forward until the checks are re-run.
    • If updating your package.json and config.schema.json files, don't forget to publish a new version to NPM.
    • Remember this is an automatic script: if you think something has been marked as a failure in error, let us know with a reply.
    • Feel free to ask any questions you have by replying to this issue.
  10. github-actions
    added
    awaiting-changesuse after review has started - awaiting user to make changes to plugin
    and removed
    pendingthe label given to a new verification/icon request
    on Oct 27, 2026
  11. NorthernMan54
    changed the title [-]Verification Request: homebridge-[/-] [+]Verification Request: homebridge-nest-accfactory-plus[/+] on Oct 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    awaiting-changesuse after review has started - awaiting user to make changes to pluginrequest-verification

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions