registry / Malware / @addai/entity-runtime

@addai/entity-runtime

Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

Daemon that pairs a machine with your +Ai account and runs Claude / Codex / Kimi / Gemini agents on its behalf. Reachable via Supabase from Vault, Entity Studio, or any other +Ai surface.

This report shows the evidence for @addai/entity-runtime@0.2.51. 12 of 16 known versions are blocked or flagged. The newest version, 0.2.58, is blocked. See all versions.

OpenSSF/OSV Malicious Advisory

imported 3mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13410 confirms this npm version as malicious.

Advisory

MAL-2026-13410

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @addai/entity-runtime (npm)

Details

The package runs a daemon that polls a hardcoded Supabase project (syhzpqqvrplaqdipcymw.supabase.co) via the RPC `runtime_pick_next_request` for remote-supplied job rows and spawns Claude Code / Codex / Kimi / Gemini / Grok in a PTY on the installer's host, driven by fields controlled by the paired remote party (prompt, permissionMode, appendSystemPrompt, allowedTools, model, workingDirectory). In `dist/session-runner.js`, `spawnClaudeForRuntime` invokes the agent binary through a login shell (`['-l','-c','exec "$@"',...]`) and, when `input.permissionMode === 'bypassPermissions'`, passes `--dangerously-skip-permissions`, letting the remotely-driven AI agent execute arbitrary shell tools as the local user without any interactive prompt. On start, `ensureBypassPermissionsAccepted()` in `dist/index.js` also writes `skipDangerousModePermissionPrompt: true` into the installer's user-global `~/.claude/settings.json`, disabling Claude Code's own bypass-permissions safety dialog for every future interactive Claude Code session the installer runs — not just those spawned by this daemon. `dist/capabilities.js` additionally reads `~/.kimi/config` and modifies PATH. The net effect is a persistent remote-controlled channel giving the paired remote party host-level RCE on the installer's machine via the AI agent tool loop, plus a persistent lowering of a separate vendor tool's safety prompts.

References

OpenSSF/OSV advisory OpenSSF JSON PACKAGE PACKAGE PACKAGE

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

Source inspection confirms an explicit-user-started, remotely orchestrated agent runtime that weakens Claude interaction safeguards. This is a real dangerous capability, but no concrete malicious behavior or unconsented install-time AI-agent configuration mutation was found.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs the entity-runtime CLI/daemon and pairs the machine.

Impact

A paired service can cause high-privilege agent activity; no install-time foreign control-surface mutation or concrete exfiltration chain was found.

Mechanism

Remote agent orchestration with runtime Claude configuration mutation.

AI rationale

Evidence

package.jsonscripts/fix-pty-helper.jsdist/index.jsdist/claude-config.jsdist/session-runner.jsdist/command-runner.jsdist/supabase-client.js

Network endpoints2

syhzpqqvrplaqdipcymw.supabase.covault.add.ai/add/entity

Independent scan evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for AI warning decision

dist/index.js calls ensureBypassPermissionsAccepted() on daemon start.
dist/claude-config.js sets Claude's skip-dangerous-permission prompt acceptance and trusts session project paths.
dist/session-runner.js dispatches remotely requested Claude/Codex agent sessions.
dist/command-runner.js can run npm global installs for server-issued harness commands.

Evidence against

package.json postinstall only chmods node-pty's own spawn-helper.
scripts/fix-pty-helper.js has no network, credential, or agent-config access.
Agent-config writes occur after explicit daemon startup, not npm installation.
Network RPCs are package-aligned pairing/runtime services.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

6 flagged

package.jsonView file

Lines 27-63json

27 "main": "dist/index.js",

28 "bin": {

29 "entity-runtime": "dist/cli.js",

30 "entities-runtime": "dist/cli.js",

31 "addai-entity-runtime": "dist/cli.js"

32 },

33 "publishConfig": {

34 "access": "public"

35 },

36 "files": [

37 "dist",

38 "scripts",

39 "README.md"

40 ],

41 "scripts": {

42 "build": "tsc -p tsconfig.json",

43 "start": "node dist/cli.js",

44 "dev": "tsc -p tsconfig.json && node dist/cli.js",

45 "test": "npm run build && node --test test/",

46 "clean": "node -e \"fs.rmSync('dist',{recursive:true,force:true})\"",

47 "postinstall": "node scripts/fix-pty-helper.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L47

48 "prepublishOnly": "npm run build"

49 },

50 "engines": {

51 "node": ">=18"

52 },

53 "dependencies": {

54 "node-pty": "^1.1.0",

55 "ws": "^8.21.1"

56 },

57 "devDependencies": {

58 "@types/node": "^20.0.0",

59 "@types/ws": "^8.18.1",

60 "typescript": "^5.6.0"

61 }

62}

dist/command-runner.jsView file

Lines 25-65javascript

25 o["default"] = v;

26});

27var __importStar = (this && this.__importStar) || (function () {

28 var ownKeys

dist/node-health.jsView file

Lines 27-67javascript

27});

28var __importStar = (this && this.__importStar) || (function () {

29 var ownKeys = function(o) {

dist/tui.jsView file

Lines 109-149javascript

109 lines.push(dim(' harness version account models efforts'));

110 harness_registry_1.HARNESS_IDS.forEach((id, i) => lines.push(row(id, st.caps[id], i === st.sel)));

111 }

scripts/smoke-test.shView file

•path = scripts/smoke-test.sh kind = build_helper sizeBytes = 2483 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/smoke-test.shView on unpkg

dist/capabilities.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @addai/entity-runtime@0.2.45 matchedIdentity = npm:QGFkZGFpL2VudGl0eS1ydW50aW1l:0.2.45 similarity = 0.615 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/capabilities.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-pty-helper.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/command-runner.jsView file

45exports.wake = wake; L46: const child_process_1 = require("child_process"); L47: const fs = __importStar(require("fs"));

High

Child Process

Package source references child process execution.

dist/command-runner.jsView on unpkg · L45

dist/node-health.jsView file

47exports.readDiskUsedPct = readDiskUsedPct; L48: const fs = __importStar(require("fs")); L49: const DEFAULT_DISK_CRITICAL_PCT = 97;

Findings

1 Critical3 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/capabilities.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/command-runner.js

HighRuntime Package Installdist/tui.js

MediumDynamic Requiredist/node-health.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/smoke-test.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @addai/entity-runtime@0.2.51.

The versions list below shows the verdict for each recorded version.

Avoid installing @addai/entity-runtime@0.2.51. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-06 14:30:14.421Z (UTC).

Source advisory published: 2026-08-06 13:22:55.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

16 known versions

0.2.58latestMaliciousMalwareBlockPublishedJul 29, 2026, 3:27 PM 0.2.56MaliciousMalwareBlockPublishedJul 29, 2026, 12:35 PM 0.2.55MaliciousMalwareBlockPublishedJul 28, 2026, 1:18 PM 0.2.53MaliciousMalwareBlockPublishedJul 28, 2026, 9:08 AM

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @addai

Other malware packages

Behavioral surface

Related packages

More from @addai

Other malware packages

Source & flagged code