The @addai/node package versions 0.4.0, 0.5.0, 0.7.0, 0.8.0, 0.8.1, 0.8.2, 0.9.0, 0.11.0, 0.11.1, and 0.11.2 contain malicious code that installs a background daemon (dist/session-runner.js). This daemon pairs the host with a remote AI account and polls a hardcoded Supabase backend for commands. These commands include arbitrary execution of AI-agent CLIs (claude, codex, kimi, gemini, grok) with elevated permissions, remote installation and updating of npm packages, and persistence mechanisms. Additionally, the daemon probes and exfiltrates credentials from unrelated AI CLI tools and reports this data back to the attacker-controlled backend. This creates a remote access channel allowing full control over the host environment.

An attacker controlling the remote Supabase backend can execute arbitrary commands on the infected host with elevated permissions, install or update npm packages remotely, maintain persistence, and exfiltrate sensitive credential information from multiple AI CLI tools. This compromises the confidentiality, integrity, and availability of the host system and any data accessible to the installed AI agents.

No official patch or remediation is currently documented. Users should immediately uninstall all affected versions of the @addai/node package listed and avoid installing or running this package. Monitor for any unauthorized background processes or network connections to the specified Supabase backend. Since this is a malicious package, remediation involves removing the package and any related artifacts manually. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.