registry / AI-agent capability abuse / @addai/node / 0.30.3

@addai/node@0.30.3

Daemon that pairs a machine with your +Ai account and runs Claude / Codex / Kimi / Gemini agents on its behalf. Reachable via Supabase from Vault, Entity Studio, or any other +Ai surface.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The source establishes a powerful remote-control and credential-handling capability, including automatic browser extension setup and disabling a Claude safety prompt. The install hook itself is limited to node-pty repair, and no self-dependent lifecycle chain or concrete install-time attack was found.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user runs and pairs the ainode daemon; queued server commands then start desktops or run commands in them.

Impact

A compromised or over-authorized control plane could use the runtime to access copied credentials or execute commands in managed desktops.

Mechanism

Copies local agent credentials into containers and executes queued container commands.

AI rationale

Evidence

package.jsonscripts/fix-pty-helper.jsdist/claude-config.jsdist/desktop/creds.jsdist/command-runner.jsdist/desktop/vault-extension.jsassets/vault-extension/manifest.jsondist/self-update.js~/.claude/settings.json~/.claude.json~/.codex/auth.json/home/entity/.codex/auth.json/conf/vault/extension

Network endpoints2

syhzpqqvrplaqdipcymw.supabase.cocodeflows-relay.shaun-395.workers.dev

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The daemon disables Claude's dangerous-mode permission prompt on startup.
It copies host Claude, Codex, and Gemini authentication files into desktop containers.
Server-queued desktop commands can execute a supplied argument array and return captured output.
A desktop startup stages and loads the bundled Vault browser extension automatically.
The extension requests cookie access and runs on all URLs.

Evidence against

The npm postinstall only loads a local helper that repairs node-pty permissions.
The manifest has no dependency on another version of itself.
Remote self-update restricts versions to semver or a dist-tag.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node scripts/fix-pty-helper.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/command-runner.jsView file

46exports.wake = wake; L47: const child_process_1 = require("child_process"); L48: const crypto = __importStar(require("crypto"));

High

Child Process

Package source references child process execution.

dist/command-runner.jsView on unpkg · L46

dist/flows/engine-loader.jsView file

21exports.engineLoaded = engineLoaded; L22: const dynamicImport = new Function('specifier', 'return import(specifier);'); L23: let cached = null;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/flows/engine-loader.jsView on unpkg · L21

dist/unpair.jsView file

17exports.disconnectNode = disconnectNode; L18: const supabase_client_1 = require("./supabase-client"); L19: const store_1 = require("./store");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/unpair.jsView on unpkg · L17

dist/autostart-win.jsView file

13Trigger-reachable persistence chain: scripts.start -> dist/cli.js -> dist/autostart.js -> dist/autostart-win.js L13: // L14: // The task is registered from generated XML rather than `schtasks` flags, L15: // because the settings that decide whether it ever runs are not reachable ... L59: const path = __importStar(require("path")); L60: const child_process_1 = require("child_process"); L61: const autostart_1 = require("./autostart"); ... L71: * username is ambiguous on a machine joined to one. */ L72: function currentUserId(env = process.env) { L73: const user = env.USERNAME || os.userInfo().username; L74: const dom = env.USERDOMAIN; ... L81: * behaves, instead of being wedged into a VBS string or a `schtasks` argument. L82: * The redirect matters: headless stdout on Windows has nowhere el

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/autostart-win.jsView on unpkg · L13

13// L14: // The task is registered from generated XML rather than `schtasks` flags, L15: // because the settings that decide whether it ever runs are not reachable ... L59: const path = __importStar(require("path")); L60: const child_process_1 = require("child_process"); L61: const autostart_1 = require("./autostart"); ... L71: * username is ambiguous on a machine joined to one. */ L72: function currentUserId(env = process.env) { L73: const user = env.USERNAME || os.userInfo().username; L74: const dom = env.USERDOMAIN; ... L81: * behaves, instead of being wedged into a VBS string or a `schtasks` argument. L82: * The redirect matters: headless stdout on Windows has nowhere else to go, and

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/autostart-win.jsView on unpkg · L13

dist/desktop/open-viewer.jsView file

12// browser viewer is the honest fallback. L13: const child_process_1 = require("child_process"); L14: /** What we would run, as a pure value, so the choice is testable without L15: * launching anything. */ L16: function viewerCommand(platform, t, studioBase = 'https://entities.add.ai') { L17: if (platform === 'darwin' && t.vncPort) { ... L28: function openViewer(t) { L29: const cmd = viewerCommand(process.platform, t); L30: if (!cmd)

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/desktop/open-viewer.jsView on unpkg · L12

dist/codex-spawn.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. cannot send custom headers, so ${creds.length - 1} other credential ` + `field(s) were dropped`); } } toml += '\n'; continue; } // on native windows, registry commands like `npx` are .cmd shims that // codex can't createprocess directly — wrap with `cmd /c` (no-op on posix). const wrapped = (0, win_1.wrapmcpcommandforplatform)(s.command, array.isarray(s.args) ? s.args : []); toml += `[mcp_servers.${tomlstring(s.slug).slice(1, -1)}]\n`; toml += `command = ${tomlstring(wrapped.command)}\n`; if (wrapped.args.length > 0) { toml += `args = [$

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/codex-spawn.jsView on unpkg

dist/self-update.jsView file

66exports.spawnReplacement = spawnReplacement; L67: const child_process_1 = require("child_process"); L68: const fs = __importStar(require("fs")); ... L75: * L76: * npx caches each invocation under `<npm-cache>/_npx/<hash>/node_modules/…`, L77: * so that segment is the reliable npx tell on every platform (checked first:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/self-update.jsView on unpkg · L66

scripts/smoke-test.shView file

•path = scripts/smoke-test.sh kind = build_helper sizeBytes = 2483 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/smoke-test.shView on unpkg

dist/capabilities.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @addai/node@0.30.1 matchedIdentity = npm:QGFkZGFpL25vZGU:0.30.1 similarity = 0.889 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/capabilities.jsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-pty-helper.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/command-runner.jsView file

46exports.wake = wake; L47: const child_process_1 = require("child_process"); L48: const crypto = __importStar(require("crypto"));

High

Child Process

Package source references child process execution.

dist/command-runner.jsView on unpkg · L46

dist/flows/engine-loader.jsView file

21exports.engineLoaded = engineLoaded; L22: const dynamicImport = new Function('specifier', 'return import(specifier);'); L23: let cached = null;

Findings

1 Critical7 High6 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/capabilities.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/command-runner.js

HighShell

HighSandbox Evasion Gated Capabilitydist/desktop/open-viewer.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/codex-spawn.js

HighTrigger Reachable Persistencedist/autostart-win.js

HighRuntime Package Installdist/self-update.js

MediumDynamic Requiredist/unpair.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/autostart-win.js

Medium

Affected versions and remediation

This report applies to @addai/node@0.30.3.

See all versions of @addai/node for other recorded verdicts.

Review the evidence and your use of @addai/node@0.30.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-28 11:17:23.313Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @addai

Runtime surface

Behavioral surface

Related packages

More from @addai

Source & flagged code