@addai/ainode

{"modified":"2026-08-06T14:21:50Z","published":"2026-08-06T13:20:11Z","schema_version":"1.7.4","id":"MAL-2026-13409","summary":"Malicious code in @addai/ainode (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3f916e16183232b51c27001adf95092d7d88c09c23839715db72b129bdf22261)\nAfter a one-time pairing flow, the daemon in dist/session-runner.js and dist/command-runner.js polls a hardcoded Supabase project at https://syhzpqqvrplaqdipcymw.supabase.co via the `runtime_commands_pick` and `runtime_pick_next_request` RPCs and executes the returned instructions on the installer's host. `execute(row)` funnels remote command rows into `pty.spawn(bin, login.loginArgs)`, and `runRequest` / `spawnClaudeForRuntime` launch Claude, Codex, Kimi, Gemini, and Grok CLIs inside node-pty PTYs with remote-supplied prompts, working directory, allowed tools, and a `permission_mode` that can include `--dangerously-skip-permissions`. Because the spawned AI CLIs have shell and tool-execution capability, whoever controls the paired account (or bypasses Supabase RLS) obtains arbitrary command execution on the host. A separate `update_runtime` command handler (`runUpdateRuntime`) accepts a remote-supplied `input.version` and passes it through `installGlobal(version)` and `spawnReplacement`, letting the remote controller install any npm-published version of `@addai/ainode` and hand execution to it, providing persistence and version-controlled payload selection. dist/capabilities.js references PATH and `~/.kimi/config`, consistent with the daemon staging AI CLI configuration on the installer.\n","affected":[{"package":{"ecosystem":"npm","name":"@addai/ainode"},"versions":["0.3.1","0.3.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/command-runner.js","sha256":"407dc311d449de0b25fdb03f2d688175ccf92b5266e58cbc919ba20a85681fa4","tlsh":"bcb2527951fb66343873e06d476bb0122b2ea1173259cc90ba4cf7145fcd12a4ae6bf8"}],"package_integrity":[{"filename":"ainode-0.3.1.tgz","hashes":{"sha1":"835f00bcf7c79ce89b47c957e6a82d14ee617ef7","sha512_sri":"sha512-VA9LcBiFg882qXbn4W7n3/wPCIeWlvJnj1OqvaQkotoungDgSi2Vqdcbdp3Ld1SODXNoPJfBShczvWEofDnOcw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@addai/ainode/v/0.3.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@addai/ainode/v/0.3.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016387","import_time":"2026-08-06T14:19:46.513051669Z","modified_time":"2026-08-06T13:20:19Z","sha256":"3f916e16183232b51c27001adf95092d7d88c09c23839715db72b129bdf22261","source":"amazon-inspector","versions":["0.3.1"]},{"id":"IN-MAL-2026-016386","import_time":"2026-08-06T14:19:46.476570748Z","modified_time":"2026-08-06T13:20:11Z","sha256":"645933056b9ddb5512e0757bdd7afafc7ca2cfd8a5a46cf14328f9e2f80eca50","source":"amazon-inspector","versions":["0.3.0"]}]}}