The @addai/ainode npm package versions 0.3.0 and 0.3.1 contain malicious code that, after an initial pairing, allows a remote attacker to execute arbitrary commands on the host system. The malicious daemon polls a hardcoded Supabase project to receive and execute commands, including launching AI CLI tools with elevated permissions. It also supports remote updates to install any npm-published version of the package, enabling persistent and version-controlled malicious payloads.