@addai/ainode
This report shows the evidence for @addai/ainode@0.3.0. 2 of 2 known versions are blocked or flagged. See all versions.
OpenSSF/OSV Malicious Advisory
imported 3mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-13409 confirms this npm version as malicious.
Advisory
MAL-2026-13409
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @addai/ainode (npm)
Details
After a one-time pairing flow, the daemon in dist/session-runner.js and dist/command-runner.js polls a hardcoded Supabase project at https://syhzpqqvrplaqdipcymw.supabase.co via the `runtime_commands_pick` and `runtime_pick_next_request` RPCs and executes the returned instructions on the installer's host. `execute(row)` funnels remote command rows into `pty.spawn(bin, login.loginArgs)`, and `runRequest` / `spawnClaudeForRuntime` launch Claude, Codex, Kimi, Gemini, and Grok CLIs inside node-pty PTYs with remote-supplied prompts, working directory, allowed tools, and a `permission_mode` that can include `--dangerously-skip-permissions`. Because the spawned AI CLIs have shell and tool-execution capability, whoever controls the paired account (or bypasses Supabase RLS) obtains arbitrary command execution on the host. A separate `update_runtime` command handler (`runUpdateRuntime`) accepts a remote-supplied `input.version` and passes it through `installGlobal(version)` and `spawnReplacement`, letting the remote controller install any npm-published version of `@addai/ainode` and hand execution to it, providing persistence and version-controlled payload selection. dist/capabilities.js references PATH and `~/.kimi/config`, consistent with the daemon staging AI CLI configuration on the installer.
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The lifecycle hook is a narrow node-pty permission repair, but runtime startup weakens a foreign AI-agent permission safeguard. Treat as a warn-level agent extension/control risk rather than malicious npm lifecycle abuse.
Static reason
One or more suspicious static signals were detected.
Trigger
User starts the ainode daemon after installation and pairing.
Impact
Reduces Claude's permission-prompt safeguard for daemon-spawned sessions; remote control has agent-install/update capability.
Mechanism
Runtime Claude configuration mutation and authenticated remote agent orchestration.
AI rationale
The lifecycle hook is a narrow node-pty permission repair, but runtime startup weakens a foreign AI-agent permission safeguard. Treat as a warn-level agent extension/control risk rather than malicious npm lifecycle abuse.
Evidence
package.jsonscripts/fix-pty-helper.jsdist/index.jsdist/claude-config.jsdist/command-runner.jsdist/self-update.jsdist/pty-helper.js~/.claude/settings.json~/.claude.json~/.ainode
Network endpoints2
syhzpqqvrplaqdipcymw.supabase.covault.add.ai/add/entity
Independent scan evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for AI warning decision
- dist/claude-config.js writes ~/.claude/settings.json to accept bypass-permissions.
- dist/claude-config.js marks daemon session directories trusted in ~/.claude.json.
- dist/index.js invokes bypass acceptance whenever the daemon starts.
- dist/command-runner.js accepts paired remote commands to install allowlisted CLIs and self-update.
Evidence against
- package.json postinstall only loads scripts/fix-pty-helper.js.
- The postinstall helper only restores execute permission on node-pty's spawn-helper.
- No install-time network call, credential harvesting, or foreign agent-config mutation was found.
- Network RPCs target the declared +Ai Supabase service; session MCP/skill files are scoped and cleaned up.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/fix-pty-helper.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/command-runner.jsView file
46exports.wake = wake;
L47: const child_process_1 = require("child_process");
L48: const fs = __importStar(require("fs"));
High
Child Process
Package source references child process execution.
dist/command-runner.jsView on unpkg · L46dist/node-health.jsView file
47exports.readDiskUsedPct = readDiskUsedPct;
L48: const fs = __importStar(require("fs"));
L49: const DEFAULT_DISK_CRITICAL_PCT = 97;
Medium
Findings
3 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/command-runner.js
HighRuntime Package Installdist/self-update.js
MediumDynamic Requiredist/node-health.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/smoke-test.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @addai/ainode@0.3.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @addai/ainode@0.3.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.