The @addai/ainode package versions 0.3.0 and 0.3.1 include a daemon that, following a one-time pairing, polls a hardcoded Supabase backend for runtime commands. These commands are executed on the host via spawning PTYs running AI CLI tools with shell and tool execution capabilities, potentially bypassing permission restrictions. The daemon also supports remote updates that allow installing arbitrary versions of the package, facilitating persistence and flexible payload delivery. This design grants whoever controls the paired account or bypasses Supabase RLS arbitrary command execution on the host system.

An attacker controlling the paired Supabase account or bypassing its row-level security can execute arbitrary commands on the host machine where the package is installed. This includes running shell commands with elevated permissions and installing malicious package versions for persistent control. The compromise can lead to full system takeover, data theft, or further malicious activity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or official guidance is available, users should avoid installing or running versions 0.3.0 and 0.3.1 of @addai/ainode. Remove any existing installations of these versions and monitor for suspicious activity related to this package. Consider blocking network access to the hardcoded Supabase endpoint if feasible.