registry / AI-agent capability abuse / @addai/node / 0.30.1

@addai/node@0.30.1

Daemon that pairs a machine with your +Ai account and runs Claude / Codex / Kimi / Gemini agents on its behalf. Reachable via Supabase from Vault, Entity Studio, or any other +Ai surface.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The inspected source supports a warning for runtime AI-agent capability abuse and user-level persistence, but not a malware block. The postinstall hook is narrowly scoped and no covert exfiltration or install-time foreign AI-agent control-surface mutation was found.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Running the paired daemon, then using the startup command or receiving a set_autostart command.

Impact

A compromised authorized control plane could cause persistent agent execution with reduced Claude confirmation prompts.

Mechanism

Global agent-setting mutation, credential staging, and user-level autostart.

AI rationale

Evidence

package.jsonscripts/fix-pty-helper.jsdist/index.jsdist/claude-config.jsdist/codex-spawn.jsdist/command-runner.jsdist/autostart-win.js~/.claude/settings.json~/.codex/auth.json~/.codex/credentials.json~/.codex/config.json~/.ainode/startup/ainode-startup.cmd~/.ainode/startup/ainode-startup.vbs~/.ainode/startup/ainode-task.xml

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

Daemon startup changes Claude’s global setting to suppress the dangerous-mode permission prompt.
A remotely dispatched command can enable login-start persistence through the package’s autostart backend.
Codex runs receive copied or linked host authentication artifacts in a temporary runtime home.

Evidence against

The install hook only repairs execute permission on node-pty’s own spawn helper.
Persistence is exposed as an explicit CLI command and a named remote command, not an install-time action.
No source evidence showed hidden exfiltration, destructive behavior, or a foreign control-surface write during installation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node scripts/fix-pty-helper.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/command-runner.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @addai/node@0.27.0 matchedIdentity = npm:QGFkZGFpL25vZGU:0.27.0 similarity = 0.869 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/command-runner.jsView on unpkg

46exports.wake = wake; L47: const child_process_1 = require("child_process"); L48: const crypto = __importStar(require("crypto"));

High

Child Process

Package source references child process execution.

dist/command-runner.jsView on unpkg · L46

dist/flows/engine-loader.jsView file

Lines 1-41javascript

1"use strict";

2// Loading an ESM package from a CommonJS daemon.

3//

4// @addai/node-flows is ESM and its sandbox does a top-level `await

5// import('isolated-vm')` — the optional native isolate, probed at load. This

6// daemon compiles to CommonJS, and `require()` refuses an ESM graph with

7// top-level await outright (ERR_REQUIRE_ASYNC_MODULE). So the engine can only

8// ever be loaded asynchronously.

9//

10// The `new Function` is not a trick for its own sake: TypeScript with

dist/unpair.jsView file

17exports.disconnectNode = disconnectNode; L18: const supabase_client_1 = require("./supabase-client"); L19: const store_1 = require("./store");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/unpair.jsView on unpkg · L17

dist/autostart-win.jsView file

13Trigger-reachable persistence chain: scripts.start -> dist/cli.js -> dist/autostart.js -> dist/autostart-win.js L13: // L14: // The task is registered from generated XML rather than `schtasks` flags, L15: // because the settings that decide whether it ever runs are not reachable ... L59: const path = __importStar(require("path")); L60: const child_process_1 = require("child_process"); L61: const autostart_1 = require("./autostart"); ... L71: * username is ambiguous on a machine joined to one. */ L72: function currentUserId(env = process.env) { L73: const user = env.USERNAME || os.userInfo().username; L74: const dom = env.USERDOMAIN; ... L81: * behaves, instead of being wedged into a VBS string or a `schtasks` argument. L82: * The redirect matters: headless stdout on Windows has nowhere el

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/autostart-win.jsView on unpkg · L13

13// L14: // The task is registered from generated XML rather than `schtasks` flags, L15: // because the settings that decide whether it ever runs are not reachable ... L59: const path = __importStar(require("path")); L60: const child_process_1 = require("child_process"); L61: const autostart_1 = require("./autostart"); ... L71: * username is ambiguous on a machine joined to one. */ L72: function currentUserId(env = process.env) { L73: const user = env.USERNAME || os.userInfo().username; L74: const dom = env.USERDOMAIN; ... L81: * behaves, instead of being wedged into a VBS string or a `schtasks` argument. L82: * The redirect matters: headless stdout on Windows has nowhere else to go, and

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/autostart-win.jsView on unpkg · L13

dist/desktop/open-viewer.jsView file

12// browser viewer is the honest fallback. L13: const child_process_1 = require("child_process"); L14: /** What we would run, as a pure value, so the choice is testable without L15: * launching anything. */ L16: function viewerCommand(platform, t, studioBase = 'https://entities.add.ai') { L17: if (platform === 'darwin' && t.vncPort) { ... L28: function openViewer(t) { L29: const cmd = viewerCommand(process.platform, t); L30: if (!cmd)

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/desktop/open-viewer.jsView on unpkg · L12

dist/codex-spawn.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. cannot send custom headers, so ${creds.length - 1} other credential ` + `field(s) were dropped`); } } toml += '\n'; continue; } // on native windows, registry commands like `npx` are .cmd shims that // codex can't createprocess directly — wrap with `cmd /c` (no-op on posix). const wrapped = (0, win_1.wrapmcpcommandforplatform)(s.command, array.isarray(s.args) ? s.args : []); toml += `[mcp_servers.${tomlstring(s.slug).slice(1, -1)}]\n`; toml += `command = ${tomlstring(wrapped.command)}\n`; if (wrapped.args.length > 0) { toml += `args = [$

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/codex-spawn.jsView on unpkg

dist/self-update.jsView file

66exports.spawnReplacement = spawnReplacement; L67: const child_process_1 = require("child_process"); L68: const fs = __importStar(require("fs")); ... L75: * L76: * npx caches each invocation under `<npm-cache>/_npx/<hash>/node_modules/…`, L77: * so that segment is the reliable npx tell on every platform (checked first:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/self-update.jsView on unpkg · L66

scripts/smoke-test.shView file

•path = scripts/smoke-test.sh kind = build_helper sizeBytes = 2483 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/smoke-test.shView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-pty-helper.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/command-runner.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/command-runner.jsView on unpkg

46exports.wake = wake; L47: const child_process_1 = require("child_process"); L48: const crypto = __importStar(require("crypto"));

High

Child Process

Package source references child process execution.

Findings

1 Critical7 High6 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/command-runner.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/command-runner.js

HighShell

HighSandbox Evasion Gated Capabilitydist/desktop/open-viewer.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/codex-spawn.js

HighTrigger Reachable Persistencedist/autostart-win.js

HighRuntime Package Installdist/self-update.js

MediumDynamic Requiredist/unpair.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/autostart-win.js

Medium

Affected versions and remediation

This report applies to @addai/node@0.30.1.

See all versions of @addai/node for other recorded verdicts.

Review the evidence and your use of @addai/node@0.30.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-27 15:14:34.596Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @addai

Runtime surface

Behavioral surface

Related packages

More from @addai

Source & flagged code