registry / AI-agent capability abuse / @addai/node / 0.30.5

@addai/node@0.30.5

Daemon that pairs a machine with your +Ai account and runs Claude / Codex / Kimi / Gemini agents on its behalf. Reachable via Supabase from Vault, Entity Studio, or any other +Ai surface.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package has a concrete, user-impacting AI-agent control surface that suppresses safety prompts and enables persistence after daemon startup. Its lifecycle hook is limited and no self-dependency chain is present, so the source does not support a malicious-install verdict.

Static reason

One or more suspicious static signals were detected.

Trigger

Running the ainode daemon; later server-delivered commands or Claude session requests.

Impact

AI-agent safety prompts can be bypassed and the daemon can remain active across login without a local interactive confirmation at that time.

Mechanism

Global Claude permission and trust mutation plus remotely driven persistence and self-update.

AI rationale

Evidence

dist/claude-config.jsdist/index.jsdist/session-runner.jsdist/command-runner.jsdist/self-update.js~/.claude/settings.json~/.claude.json~/.ainode

Network endpoints1

syhzpqqvrplaqdipcymw.supabase.co

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Daemon startup silently accepts Claude's dangerous-permissions prompt.
Claude session runs mark generated working directories as trusted in the user's global Claude configuration.
Server-delivered commands can enable operating-system login persistence and perform self-updates.
The package is an always-on remote agent daemon with authority to launch AI tools.

Evidence against

The install hook only repairs execute permission on node-pty's helper.
package.json has no runtime dependency on @addai/node itself.
The updater restricts requested versions to semver or a dist-tag.
No source evidence shows theft or exfiltration of unrelated local files or credentials.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node scripts/fix-pty-helper.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/command-runner.jsView file

46exports.wake = wake; L47: const child_process_1 = require("child_process"); L48: const crypto = __importStar(require("crypto"));

High

Child Process

Package source references child process execution.

dist/command-runner.jsView on unpkg · L46

dist/flows/engine-loader.jsView file

Lines 1-41javascript

1"use strict";

2// Loading an ESM package from a CommonJS daemon.

3//

4// @addai/node-flows is ESM and its sandbox does a top-level `await

5// import('isolated-vm')` — the optional native isolate, probed at load. This

6// daemon compiles to CommonJS, and `require()` refuses an ESM graph with

7// top-level await outright (ERR_REQUIRE_ASYNC_MODULE). So the engine can only

8// ever be loaded asynchronously.

9//

10// The `new Function` is not a trick for its own sake: TypeScript with

11// `module: CommonJS` rewrites a plain `import()` into `require()`, which is

12// precisely the call that fails. Hiding the import inside a function body the

13// compiler will not touch is what keeps it a real dynamic import at runtime.

14//

15// Loading is also lazy on purpose. A machine that never runs flows should

16// never pay to load the engine, and on a machine where the native sandbox

17// failed to build, the failure should surface when someone turns flows on —

18// not as a daemon that will not start.

19Object.defineProperty(exports, "__esModule", { value: true });

20exports.loadEngine = loadEngine;

21exports.engineLoaded = engineLoaded;

22const dynamicImport = new Function('specifier', 'return import(specifier);');

23let cached = null;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/flows/engine-loader.jsView on unpkg · L21

24/** Load the engine once and reuse it. The promise is cached rather than the

25 * module, so concurrent first calls share one load instead of racing. */

26function loadEngine() {

27 if (!cached) {

28 cached = dynamicImport('@addai/node-flows').catch((err) => {

29 // Clear the cache so a later attempt can retry — a transient failure

30 // (a half-written install, say) must not poison the process for good.

31 cached = null;

32 throw new Error(`The flows engine could not be loaded: ${err.message}. `

33 + 'Reinstall @addai/node, or turn flows off for this machine.');

34 });

35 }

36 return cached;

37}

38/** Has the engine been loaded already? Lets the capabilities probe report the

39 * sandbox without forcing a load on a machine that does not run flows. */

40function engineLoaded() { return cached !== null; }

dist/unpair.jsView file

Lines 1-37javascript

1"use strict";

2// Disconnecting a node from +Ai.

3//

4// Shared by `ainode unpair` and the console's disconnect key, because the two

5// must not drift: this is the one action that takes work away from people, and

6// a version of it that forgets to cancel in-flight runs would leave whoever

7// was waiting on them waiting forever.

8//

9// The server soft-disables rather than deletes: the runtime row, its history

10// and its chats all survive, the token is scrubbed, and the status becomes

dist/autostart-win.jsView file

Lines 1-33javascript

1"use strict";

2// Windows backend: a Task Scheduler logon task.

3//

4// Three shapes were possible and only this one is both hidden and durable:

5//

6// Startup-folder shortcut — trivial, but pops a console window at every

7// logon and nothing brings the node back if it dies.

8// Windows Service — survives with nobody logged in, but runs outside the

9// user's session: no keychain, no user PATH, no ~/.claude. It would boot

10// a node that fails every run.

dist/desktop/open-viewer.jsView file

Lines 1-32javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.viewerCommand = viewerCommand;

4exports.openViewer = openViewer;

5// Open a desktop in whatever this machine calls a screen viewer.

dist/claude-config.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. var __createbinding = (this && this.__createbinding) || (object.create ? (function(o, m, k, k2) { if (k2 === undefined) k2 = k; var desc = object.getownpropertydescriptor(m, k); if (!desc || ("get" in desc ? !m.__esmodule : desc.writable || desc.configurable)) { desc = { enumerable: true, get: function() { return m[k]; } }; } object.defineproperty(o, k2, desc); }) : (function(o, m, k, k2) { if (k2 === undefined) k2 = k; o[k2] = m[k]; })); var __setmoduledefault = (this && this.__setmoduledefault) || (object.create ? (function(o, v) { object.defineproperty(o, "default", { enumerable: true, value: v }); }) : function(o, v) { o["default"] =

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/claude-config.jsView on unpkg

dist/autostart-mac.jsView file

Lines 28-68javascript

28 return ar;

29 };

30 return ownKeys(o);

31 };

32 return function (mod) {

33 if (mod &&

dist/self-update.jsView file

Lines 46-86javascript

46 return function (mod) {

47 if (mod && mod.__esModule) return mod;

48 var result = {};

49 if (mod != null

scripts/smoke-test.shView file

•path = scripts/smoke-test.sh kind = build_helper sizeBytes = 2483 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/smoke-test.shView on unpkg

dist/autostart-linux.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 14

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/autostart-linux.js#virtual:normalized:round1View on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-pty-helper.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/command-runner.jsView file

46exports.wake = wake; L47: const child_process_1 = require("child_process"); L48: const crypto = __importStar(require("crypto"));

High

Child Process

Package source references child process execution.

dist/command-runner.jsView on unpkg · L46

dist/flows/engine-loader.jsView file

21exports.engineLoaded = engineLoaded; L22: const dynamicImport = new Function('specifier', 'return import(specifier);'); L23: let cached = null;

Findings

8 High6 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/command-runner.js

HighShell

HighSandbox Evasion Gated Capabilitydist/desktop/open-viewer.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/claude-config.js

HighTrigger Reachable Persistencedist/autostart-mac.js

HighRuntime Package Installdist/self-update.js

HighSemantic Analysis Limiteddist/autostart-linux.js#virtual:normalized:round1

MediumDynamic Requiredist/unpair.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/autostart-win.js

Medium

Affected versions and remediation

This report applies to @addai/node@0.30.5.

See all versions of @addai/node for other recorded verdicts.

Review the evidence and your use of @addai/node@0.30.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-01 13:21:22.798Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @addai

Runtime surface

Behavioral surface

Related packages

More from @addai

Source & flagged code