registry / AI-agent capability abuse / @addai/node / 0.30.2

@addai/node@0.30.2

Daemon that pairs a machine with your +Ai account and runs Claude / Codex / Kimi / Gemini agents on its behalf. Reachable via Supabase from Vault, Entity Studio, or any other +Ai surface.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Source confirms a package-owned daemon startup routine suppresses Claude's bypass-permissions warning, which is a concrete agent capability risk. The inspected manifest's postinstall hook runs a separate PTY repair script, so the source does not establish an install-time control-surface mutation.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The user starts the daemon.

Impact

Claude's warning about bypass permissions can be suppressed for daemon-launched sessions.

Mechanism

Startup sets `skipDangerousModePermissionPrompt` to true in the user's Claude settings file.

AI rationale

Evidence

dist/claude-config.jsdist/index.js~/.claude/settings.json

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Starting the daemon calls a routine that edits the user's Claude settings.
That routine sets `skipDangerousModePermissionPrompt` to true in `~/.claude/settings.json`.
The npm postinstall hook only runs the PTY helper repair script.

Evidence against

The Claude settings mutation runs when the daemon starts; the manifest postinstall hook runs a separate helper script.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 107 file(s), 1.29 MB of source, external domains: 127.0.0.1, add.ai, addai-flows-backend-29522465016.europe-west2.run.app, auth.add.ai, desktop.docker.com, developer.mozilla.org, docker.com, entities.add.ai, get.docker.com, github.com, grok.com, node.add.ai, schemas.microsoft.com, syhzpqqvrplaqdipcymw.supabase.co, vault.add.ai, www.apple.com

Source & flagged code

12 flagged

package.jsonView file

•scripts.postinstall = node scripts/fix-pty-helper.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/command-runner.jsView file

46exports.wake = wake; L47: const child_process_1 = require("child_process"); L48: const crypto = __importStar(require("crypto"));

High

Child Process

Package source references child process execution.

dist/command-runner.jsView on unpkg · L46

dist/flows/engine-loader.jsView file

21exports.engineLoaded = engineLoaded; L22: const dynamicImport = new Function('specifier', 'return import(specifier);'); L23: let cached = null;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/flows/engine-loader.jsView on unpkg · L21

dist/unpair.jsView file

17exports.disconnectNode = disconnectNode; L18: const supabase_client_1 = require("./supabase-client"); L19: const store_1 = require("./store");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/unpair.jsView on unpkg · L17

dist/autostart-win.jsView file

Lines 1-33javascript

1"use strict";

2// Windows backend: a Task Scheduler logon task.

3//

4// Three shapes were possible and only this one is both hidden and durable:

5//

6// Startup-folder shortcut — trivial, but pops a console window at every

7// logon and nothing brings the node back if it dies.

8// Windows Service — survives with nobody logged in, but runs outside the

9// user's session: no keychain, no user PATH, no ~/.claude. It would boot

10// a node that fails every run.

dist/desktop/open-viewer.jsView file

Lines 1-32javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.viewerCommand = viewerCommand;

4exports.openViewer = openViewer;

5// Open a desktop in whatever this machine calls a screen viewer.

dist/claude-config.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. var __createbinding = (this && this.__createbinding) || (object.create ? (function(o, m, k, k2) { if (k2 === undefined) k2 = k; var desc = object.getownpropertydescriptor(m, k); if (!desc || ("get" in desc ? !m.__esmodule : desc.writable || desc.configurable)) { desc = { enumerable: true, get: function() { return m[k]; } }; } object.defineproperty(o, k2, desc); }) : (function(o, m, k, k2) { if (k2 === undefined) k2 = k; o[k2] = m[k]; })); var __setmoduledefault = (this && this.__setmoduledefault) || (object.create ? (function(o, v) { object.defineproperty(o, "default", { enumerable: true, value: v }); }) : function(o, v) { o["default"] =

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/claude-config.jsView on unpkg

dist/autostart-mac.jsView file

48Trigger-reachable persistence chain: scripts.start -> dist/cli.js -> dist/autostart.js -> dist/autostart-mac.js L48: const path = __importStar(require("path")); L49: const child_process_1 = require("child_process"); L50: const autostart_1 = require("./autostart"); L51: exports.PLIST_PATH = path.join(os.homedir(), 'Library', 'LaunchAgents', `${autostart_1.LABEL}.plist`); L52: /** `<string>` bodies are the only place user data lands in the plist, and a ... L127: * open() and the process HANGS in module resolution rather than failing. L128: * `launchctl print` says the job is fine. It is not. L129: * ... L172: try { L173: // stderr is piped, not inherited: `bootout` on a label that isn't loaded L174: // prints "Boot-out failed: 3: No such process", and that expected no-op

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/autostart-mac.jsView on unpkg · L48

dist/self-update.jsView file

Lines 46-86javascript

46 return function (mod) {

47 if (mod && mod.__esModule) return mod;

48 var result = {};

49 if (mod != null

scripts/smoke-test.shView file

•path = scripts/smoke-test.sh kind = build_helper sizeBytes = 2483 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/smoke-test.shView on unpkg

dist/autostart-linux.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/autostart-linux.js#virtual:normalized:round1View on unpkg

dist/capabilities.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @addai/node@0.30.11 matchedIdentity = npm:QGFkZGFpL25vZGU:0.30.11 similarity = 0.835 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/capabilities.jsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-pty-helper.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/command-runner.jsView file

46exports.wake = wake; L47: const child_process_1 = require("child_process"); L48: const crypto = __importStar(require("crypto"));

High

Child Process

Package source references child process execution.

dist/command-runner.jsView on unpkg · L46

dist/flows/engine-loader.jsView file

21exports.engineLoaded = engineLoaded; L22: const dynamicImport = new Function('specifier', 'return import(specifier);'); L23: let cached = null;

Findings

1 Critical8 High6 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/capabilities.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/command-runner.js

HighShell

HighSandbox Evasion Gated Capabilitydist/desktop/open-viewer.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/claude-config.js

HighTrigger Reachable Persistencedist/autostart-mac.js

HighRuntime Package Installdist/self-update.js

HighSemantic Analysis Limiteddist/autostart-linux.js#virtual:normalized:round1

MediumDynamic Requiredist/unpair.js

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to @addai/node@0.30.2.

See all versions of @addai/node for other recorded verdicts.

Review the evidence and your use of @addai/node@0.30.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 19:06:03.972Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @addai

Runtime surface

Behavioral surface

Related packages

More from @addai

Source & flagged code