MAL-2026-13409

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@addai/ainode/MAL-2026-13409.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13409
Published
2026-08-06T13:20:11Z
Modified
2026-08-06T14:34:54Z
Summary
Malicious code in @addai/ainode (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3f916e16183232b51c27001adf95092d7d88c09c23839715db72b129bdf22261)

After a one-time pairing flow, the daemon in dist/session-runner.js and dist/command-runner.js polls a hardcoded Supabase project at https://syhzpqqvrplaqdipcymw.supabase.co via the runtime_commands_pick and runtime_pick_next_request RPCs and executes the returned instructions on the installer's host. execute(row) funnels remote command rows into pty.spawn(bin, login.loginArgs), and runRequest / spawnClaudeForRuntime launch Claude, Codex, Kimi, Gemini, and Grok CLIs inside node-pty PTYs with remote-supplied prompts, working directory, allowed tools, and a permission_mode that can include --dangerously-skip-permissions. Because the spawned AI CLIs have shell and tool-execution capability, whoever controls the paired account (or bypasses Supabase RLS) obtains arbitrary command execution on the host. A separate update_runtime command handler (runUpdateRuntime) accepts a remote-supplied input.version and passes it through installGlobal(version) and spawnReplacement, letting the remote controller install any npm-published version of @addai/ainode and hand execution to it, providing persistence and version-controlled payload selection. dist/capabilities.js references PATH and ~/.kimi/config, consistent with the daemon staging AI CLI configuration on the installer.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-016387",
            "import_time":  "2026-08-06T14:19:46.513051669Z",
            "modified_time":  "2026-08-06T13:20:19Z",
            "sha256":  "3f916e16183232b51c27001adf95092d7d88c09c23839715db72b129bdf22261",
            "source":  "amazon-inspector",
            "versions":  [
                "0.3.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-016386",
            "import_time":  "2026-08-06T14:19:46.476570748Z",
            "modified_time":  "2026-08-06T13:20:11Z",
            "sha256":  "645933056b9ddb5512e0757bdd7afafc7ca2cfd8a5a46cf14328f9e2f80eca50",
            "source":  "amazon-inspector",
            "versions":  [
                "0.3.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @addai/ainode

Package

Name
@addai/ainode
View open source insights on deps.dev
Purl
pkg:npm/%40addai/ainode

Affected ranges

Affected versions

0.*
0.3.0
0.3.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "dist/command-runner.js",
            "sha256":  "407dc311d449de0b25fdb03f2d688175ccf92b5266e58cbc919ba20a85681fa4",
            "tlsh":  "bcb2527951fb66343873e06d476bb0122b2ea1173259cc90ba4cf7145fcd12a4ae6bf8"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "ainode-0.3.1.tgz",
            "hashes":  {
                "sha1":  "835f00bcf7c79ce89b47c957e6a82d14ee617ef7",
                "sha512_sri":  "sha512-VA9LcBiFg882qXbn4W7n3/wPCIeWlvJnj1OqvaQkotoungDgSi2Vqdcbdp3Ld1SODXNoPJfBShczvWEofDnOcw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@addai/ainode/MAL-2026-13409.json"