registry / AI-agent capability abuse / @addai/node / 0.30.4

@addai/node@0.30.4

Daemon that pairs a machine with your +Ai account and runs Claude / Codex / Kimi / Gemini agents on its behalf. Reachable via Supabase from Vault, Entity Studio, or any other +Ai surface.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The lifecycle hook is limited to repairing a bundled dependency permission, so blocking for install-hook abuse is not supported. However, the daemon deliberately modifies global Claude safety and trust controls and can invoke bypass mode.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs ainode, ainode run, or ainode start; a paired daemon then processes a Claude request.

Impact

Remote work dispatched through the daemon can execute with reduced Claude safety confirmation and trusted-directory protections.

Mechanism

Global Claude trust and permission-prompt suppression combined with bypass-mode agent launches.

AI rationale

Evidence

dist/index.jsdist/claude-config.jsdist/session-runner.jsdist/claude-spawn.js~/.claude/settings.json~/.claude.json

Network endpoints1

syhzpqqvrplaqdipcymw.supabase.co

Decision evidence

public snapshot

AI called this Suspicious at 97.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Daemon startup silently sets Claude Code's global bypass-confirmation setting to true.
The CLI starts that daemon for ordinary ainode/run invocations, before pairing completes.
Remote session handling pre-trusts arbitrary ephemeral directories in the user's Claude configuration.
It can launch Claude with the dangerously-skip-permissions flag.

Evidence against

The install hook only repairs node-pty executable permissions and exits on failure.
The dangerous configuration changes are not executed by npm postinstall; they require running the CLI daemon.
No source evidence shows unrelated credential harvesting or exfiltration.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node scripts/fix-pty-helper.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/command-runner.jsView file

46exports.wake = wake; L47: const child_process_1 = require("child_process"); L48: const crypto = __importStar(require("crypto"));

High

Child Process

Package source references child process execution.

dist/command-runner.jsView on unpkg · L46

dist/flows/engine-loader.jsView file

21exports.engineLoaded = engineLoaded; L22: const dynamicImport = new Function('specifier', 'return import(specifier);'); L23: let cached = null;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/flows/engine-loader.jsView on unpkg · L21

dist/unpair.jsView file

17exports.disconnectNode = disconnectNode; L18: const supabase_client_1 = require("./supabase-client"); L19: const store_1 = require("./store");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/unpair.jsView on unpkg · L17

dist/autostart-win.jsView file

13// L14: // The task is registered from generated XML rather than `schtasks` flags, L15: // because the settings that decide whether it ever runs are not reachable ... L59: const path = __importStar(require("path")); L60: const child_process_1 = require("child_process"); L61: const autostart_1 = require("./autostart"); ... L71: * username is ambiguous on a machine joined to one. */ L72: function currentUserId(env = process.env) { L73: const user = env.USERNAME || os.userInfo().username; L74: const dom = env.USERDOMAIN; ... L81: * behaves, instead of being wedged into a VBS string or a `schtasks` argument. L82: * The redirect matters: headless stdout on Windows has nowhere else to go, and

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/autostart-win.jsView on unpkg · L13

dist/desktop/open-viewer.jsView file

12// browser viewer is the honest fallback. L13: const child_process_1 = require("child_process"); L14: /** What we would run, as a pure value, so the choice is testable without L15: * launching anything. */ L16: function viewerCommand(platform, t, studioBase = 'https://entities.add.ai') { L17: if (platform === 'darwin' && t.vncPort) { ... L28: function openViewer(t) { L29: const cmd = viewerCommand(process.platform, t); L30: if (!cmd)

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/desktop/open-viewer.jsView on unpkg · L12

dist/claude-config.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. var __createbinding = (this && this.__createbinding) || (object.create ? (function(o, m, k, k2) { if (k2 === undefined) k2 = k; var desc = object.getownpropertydescriptor(m, k); if (!desc || ("get" in desc ? !m.__esmodule : desc.writable || desc.configurable)) { desc = { enumerable: true, get: function() { return m[k]; } }; } object.defineproperty(o, k2, desc); }) : (function(o, m, k, k2) { if (k2 === undefined) k2 = k; o[k2] = m[k]; })); var __setmoduledefault = (this && this.__setmoduledefault) || (object.create ? (function(o, v) { object.defineproperty(o, "default", { enumerable: true, value: v }); }) : function(o, v) { o["default"] =

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/claude-config.jsView on unpkg

dist/autostart-mac.jsView file

48Trigger-reachable persistence chain: scripts.start -> dist/cli.js -> dist/autostart.js -> dist/autostart-mac.js L48: const path = __importStar(require("path")); L49: const child_process_1 = require("child_process"); L50: const autostart_1 = require("./autostart"); L51: exports.PLIST_PATH = path.join(os.homedir(), 'Library', 'LaunchAgents', `${autostart_1.LABEL}.plist`); L52: /** `<string>` bodies are the only place user data lands in the plist, and a ... L127: * open() and the process HANGS in module resolution rather than failing. L128: * `launchctl print` says the job is fine. It is not. L129: * ... L172: try { L173: // stderr is piped, not inherited: `bootout` on a label that isn't loaded L174: // prints "Boot-out failed: 3: No such process", and that expected no-op

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/autostart-mac.jsView on unpkg · L48

dist/self-update.jsView file

66exports.spawnReplacement = spawnReplacement; L67: const child_process_1 = require("child_process"); L68: const fs = __importStar(require("fs")); ... L75: * L76: * npx caches each invocation under `<npm-cache>/_npx/<hash>/node_modules/…`, L77: * so that segment is the reliable npx tell on every platform (checked first:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/self-update.jsView on unpkg · L66

scripts/smoke-test.shView file

•path = scripts/smoke-test.sh kind = build_helper sizeBytes = 2483 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/smoke-test.shView on unpkg

dist/autostart-linux.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 14

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/autostart-linux.js#virtual:normalized:round1View on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-pty-helper.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/command-runner.jsView file

46exports.wake = wake; L47: const child_process_1 = require("child_process"); L48: const crypto = __importStar(require("crypto"));

High

Child Process

Package source references child process execution.

dist/command-runner.jsView on unpkg · L46

dist/flows/engine-loader.jsView file

21exports.engineLoaded = engineLoaded; L22: const dynamicImport = new Function('specifier', 'return import(specifier);'); L23: let cached = null;

Findings

8 High6 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/command-runner.js

HighShell

HighSandbox Evasion Gated Capabilitydist/desktop/open-viewer.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/claude-config.js

HighTrigger Reachable Persistencedist/autostart-mac.js

HighRuntime Package Installdist/self-update.js

HighSemantic Analysis Limiteddist/autostart-linux.js#virtual:normalized:round1

MediumDynamic Requiredist/unpair.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/autostart-win.js

Medium

Affected versions and remediation

This report applies to @addai/node@0.30.4.

See all versions of @addai/node for other recorded verdicts.

Review the evidence and your use of @addai/node@0.30.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-01 12:16:20.422Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @addai

Runtime surface

Behavioral surface

Related packages

More from @addai

Source & flagged code