registry / AI-agent capability abuse / @addai/node / 0.30.12

@addai/node@0.30.12

Daemon that pairs a machine with your +Ai account and runs Claude / Codex / Kimi / Gemini agents on its behalf. Reachable via Supabase from Vault, Entity Studio, or any other +Ai surface.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The daemon automatically suppresses Claude’s bypass-permissions warning and pre-trusts session directories, creating a concrete agent capability risk. The inspected behavior is runtime-triggered, not a malicious npm lifecycle mutation; classify it as suspicious and warn.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Starting the ainode daemon.

Impact

Claude’s bypass-permissions warning can be suppressed for daemon-launched sessions, reducing a user-facing safety prompt.

Mechanism

The runtime sets skipDangerousModePermissionPrompt to true in the user’s Claude settings; Claude project trust is also pre-accepted for a spawned session cwd.

AI rationale

Evidence

dist/claude-config.jsdist/index.jsdist/session-runner.js

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Starting the daemon writes skipDangerousModePermissionPrompt=true to the user’s Claude settings, suppressing a warning for bypass-permissions mode.
The Claude helper targets the user’s home configuration; this mutation is reached during daemon startup, not the npm postinstall hook.
Codex setup can link or copy the user’s authentication files into its sandbox directory for agent use.
Grok and Kimi setup writes per-session MCP configuration; the general MCP config is limited to caller-requested servers.
The runtime installer writes skills into the session working directory, and the precompact hook writes session-scoped Claude settings.
The manifest’s postinstall runs a PTY helper repair; it does not invoke the Claude configuration mutation.

Evidence against

The inspected Claude permission change runs when the daemon starts, while the npm postinstall hook calls a PTY helper repair.
The inspected MCP and hook configuration writes are scoped to a session or working directory.

Behavioral surface

Source

ChildProcess

Source & flagged code

13 flagged

package.jsonView file

•scripts.postinstall = node scripts/fix-pty-helper.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/claude-system-prompt.jsView file

62const crypto_1 = require("crypto"); L63: const child_process_1 = require("child_process"); L64: const win_1 = require("./win");

High

Child Process

Package source references child process execution.

dist/claude-system-prompt.jsView on unpkg · L62

dist/claude-binary.jsView file

89// windowsHide and a discarded stderr — see whereLookup in win.ts for L90: // why. execSync goes through cmd.exe, so a miss here costs a console L91: // window AND a line of noise in daemon.log every time it runs.

High

Shell

Package source references shell execution.

dist/claude-binary.jsView on unpkg · L89

dist/flows/engine-loader.jsView file

Lines 1-41javascript

1"use strict";

2// Loading an ESM package from a CommonJS daemon.

3//

4// @addai/node-flows is ESM and its sandbox does a top-level `await

5// import('isolated-vm')` — the optional native isolate, probed at load. This

6// daemon compiles to CommonJS, and `require()` refuses an ESM graph with

7// top-level await outright (ERR_REQUIRE_ASYNC_MODULE). So the engine can only

8// ever be loaded asynchronously.

9//

10// The `new Function` is not a trick for its own sake: TypeScript with

dist/unpair.jsView file

17exports.disconnectNode = disconnectNode; L18: const supabase_client_1 = require("./supabase-client"); L19: const store_1 = require("./store");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/unpair.jsView on unpkg · L17

dist/autostart-win.jsView file

13// L14: // The task is registered from generated XML rather than `schtasks` flags, L15: // because the settings that decide whether it ever runs are not reachable ... L59: const path = __importStar(require("path")); L60: const child_process_1 = require("child_process"); L61: const autostart_1 = require("./autostart"); ... L71: * username is ambiguous on a machine joined to one. */ L72: function currentUserId(env = process.env) { L73: const user = env.USERNAME || os.userInfo().username; L74: const dom = env.USERDOMAIN; ... L81: * behaves, instead of being wedged into a VBS string or a `schtasks` argument. L82: * The redirect matters: headless stdout on Windows has nowhere else to go, and

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/autostart-win.jsView on unpkg · L13

dist/desktop/open-viewer.jsView file

12// browser viewer is the honest fallback. L13: const child_process_1 = require("child_process"); L14: /** What we would run, as a pure value, so the choice is testable without L15: * launching anything. */ L16: function viewerCommand(platform, t, studioBase = 'https://entities.add.ai') { L17: if (platform === 'darwin' && t.vncPort) { ... L28: function openViewer(t) { L29: const cmd = viewerCommand(process.platform, t); L30: if (!cmd)

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/desktop/open-viewer.jsView on unpkg · L12

dist/claude-config.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. var __createbinding = (this && this.__createbinding) || (object.create ? (function(o, m, k, k2) { if (k2 === undefined) k2 = k; var desc = object.getownpropertydescriptor(m, k); if (!desc || ("get" in desc ? !m.__esmodule : desc.writable || desc.configurable)) { desc = { enumerable: true, get: function() { return m[k]; } }; } object.defineproperty(o, k2, desc); }) : (function(o, m, k, k2) { if (k2 === undefined) k2 = k; o[k2] = m[k]; })); var __setmoduledefault = (this && this.__setmoduledefault) || (object.create ? (function(o, v) { object.defineproperty(o, "default", { enumerable: true, value: v }); }) : function(o, v) { o["default"] =

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/claude-config.jsView on unpkg

dist/autostart-mac.jsView file

48Trigger-reachable persistence chain: scripts.start -> dist/cli.js -> dist/autostart.js -> dist/autostart-mac.js L48: const path = __importStar(require("path")); L49: const child_process_1 = require("child_process"); L50: const autostart_1 = require("./autostart"); L51: exports.PLIST_PATH = path.join(os.homedir(), 'Library', 'LaunchAgents', `${autostart_1.LABEL}.plist`); L52: /** `<string>` bodies are the only place user data lands in the plist, and a ... L127: * open() and the process HANGS in module resolution rather than failing. L128: * `launchctl print` says the job is fine. It is not. L129: * ... L172: try { L173: // stderr is piped, not inherited: `bootout` on a label that isn't loaded L174: // prints "Boot-out failed: 3: No such process", and that expected no-op

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/autostart-mac.jsView on unpkg · L48

dist/self-update.jsView file

66exports.spawnReplacement = spawnReplacement; L67: const child_process_1 = require("child_process"); L68: const fs = __importStar(require("fs")); ... L75: * L76: * npx caches each invocation under `<npm-cache>/_npx/<hash>/node_modules/…`, L77: * so that segment is the reliable npx tell on every platform (checked first:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/self-update.jsView on unpkg · L66

scripts/smoke-test.shView file

•path = scripts/smoke-test.sh kind = build_helper sizeBytes = 2483 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/smoke-test.shView on unpkg

dist/autostart-linux.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 14

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/autostart-linux.js#virtual:normalized:round1View on unpkg

dist/codex-spawn.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @addai/node@0.30.11 matchedIdentity = npm:QGFkZGFpL25vZGU:0.30.11 similarity = 0.991 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/codex-spawn.jsView on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-pty-helper.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/claude-system-prompt.jsView file

62const crypto_1 = require("crypto"); L63: const child_process_1 = require("child_process"); L64: const win_1 = require("./win");

High

Child Process

Package source references child process execution.

dist/claude-system-prompt.jsView on unpkg · L62

dist/claude-binary.jsView file

Findings

1 Critical8 High6 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/codex-spawn.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/claude-system-prompt.js

HighShelldist/claude-binary.js

HighSandbox Evasion Gated Capabilitydist/desktop/open-viewer.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/claude-config.js

HighTrigger Reachable Persistencedist/autostart-mac.js

HighRuntime Package Installdist/self-update.js

HighSemantic Analysis Limiteddist/autostart-linux.js#virtual:normalized:round1

MediumDynamic Requiredist/unpair.js

MediumNetwork

Affected versions and remediation

This report applies to @addai/node@0.30.12.

See all versions of @addai/node for other recorded verdicts.

Review the evidence and your use of @addai/node@0.30.12 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 19:06:10.303Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @addai

Runtime surface

Behavioral surface

Related packages

More from @addai

Source & flagged code