registry / @addai/ainode / 0.3.0

@addai/ainode@0.3.0

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Starting the daemon suppresses Claude Code's bypass-permissions warning and pre-trusts its ephemeral project directories. A paired remote control plane can then dispatch the package's defined agent-management actions.

Static reason

One or more suspicious static signals were detected.

Trigger

User starts the ainode daemon after installation and pairing.

Impact

Reduces Claude's permission-prompt safeguard for daemon-spawned sessions; remote control has agent-install/update capability.

Mechanism

Runtime Claude configuration mutation and authenticated remote agent orchestration.

Rationale

The lifecycle hook is a narrow node-pty permission repair, but runtime startup weakens a foreign AI-agent permission safeguard. Treat as a warn-level agent extension/control risk rather than malicious npm lifecycle abuse.

Evidence

package.jsonscripts/fix-pty-helper.jsdist/index.jsdist/claude-config.jsdist/command-runner.jsdist/self-update.jsdist/pty-helper.js~/.claude/settings.json~/.claude.json~/.ainode

Network endpoints2

syhzpqqvrplaqdipcymw.supabase.covault.add.ai/add/entity

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13409

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @addai/ainode (npm)

Details

After a one-time pairing flow, the daemon in dist/session-runner.js and dist/command-runner.js polls a hardcoded Supabase project at https://syhzpqqvrplaqdipcymw.supabase.co via the `runtime_commands_pick` and `runtime_pick_next_request` RPCs and executes the returned instructions on the installer's host. `execute(row)` funnels remote command rows into `pty.spawn(bin, login.loginArgs)`, and `runRequest` / `spawnClaudeForRuntime` launch Claude, Codex, Kimi, Gemini, and Grok CLIs inside node-pty PTYs with remote-supplied prompts, working directory, allowed tools, and a `permission_mode` that can include `--dangerously-skip-permissions`. Because the spawned AI CLIs have shell and tool-execution capability, whoever controls the paired account (or bypasses Supabase RLS) obtains arbitrary command execution on the host. A separate `update_runtime` command handler (`runUpdateRuntime`) accepts a remote-supplied `input.version` and passes it through `installGlobal(version)` and `spawnReplacement`, letting the remote controller install any npm-published version of `@addai/ainode` and hand execution to it, providing persistence and version-controlled payload selection. dist/capabilities.js references PATH and `~/.kimi/config`, consistent with the daemon staging AI CLI configuration on the installer.

References

OSV advisory OpenSSF JSON PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for block

dist/claude-config.js writes ~/.claude/settings.json to accept bypass-permissions.
dist/claude-config.js marks daemon session directories trusted in ~/.claude.json.
dist/index.js invokes bypass acceptance whenever the daemon starts.
dist/command-runner.js accepts paired remote commands to install allowlisted CLIs and self-update.

Evidence against

package.json postinstall only loads scripts/fix-pty-helper.js.
The postinstall helper only restores execute permission on node-pty's spawn-helper.
No install-time network call, credential harvesting, or foreign agent-config mutation was found.
Network RPCs target the declared +Ai Supabase service; session MCP/skill files are scoped and cleaned up.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node scripts/fix-pty-helper.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/command-runner.jsView file

46exports.wake = wake; L47: const child_process_1 = require("child_process"); L48: const fs = __importStar(require("fs"));

High

Child Process

Package source references child process execution.

dist/command-runner.jsView on unpkg · L46

dist/node-health.jsView file

47exports.readDiskUsedPct = readDiskUsedPct; L48: const fs = __importStar(require("fs")); L49: const DEFAULT_DISK_CRITICAL_PCT = 97;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/node-health.jsView on unpkg · L47

dist/self-update.jsView file

62exports.spawnReplacement = spawnReplacement; L63: const child_process_1 = require("child_process"); L64: const fs = __importStar(require("fs")); ... L70: * L71: * npx caches each invocation under `<npm-cache>/_npx/<hash>/node_modules/…`, L72: * so that segment is the reliable npx tell on every platform (checked first:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/self-update.jsView on unpkg · L62

scripts/smoke-test.shView file

•path = scripts/smoke-test.sh kind = build_helper sizeBytes = 2409 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/smoke-test.shView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-pty-helper.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/command-runner.jsView file

46exports.wake = wake; L47: const child_process_1 = require("child_process"); L48: const fs = __importStar(require("fs"));

High

Child Process

Package source references child process execution.

dist/command-runner.jsView on unpkg · L46

dist/node-health.jsView file

47exports.readDiskUsedPct = readDiskUsedPct; L48: const fs = __importStar(require("fs")); L49: const DEFAULT_DISK_CRITICAL_PCT = 97;

Medium

Findings

3 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/command-runner.js

HighRuntime Package Installdist/self-update.js

MediumDynamic Requiredist/node-health.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/smoke-test.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings