Malicious code in @addai/entity-runtime (npm)
The npm package @addai/entity-runtime contained malicious code that establishes a persistent remote-controlled daemon polling a hardcoded Supabase backend for commands. The package spawns AI agents (Claude, Codex, Kimi, Gemini, Grok) with dangerous permission bypasses, enabling remote code execution as the installing user and permanently disabling safety prompts in the user's local Claude configuration.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed affected versions of @addai/entity-runtime
- Ecosystems
- Attack vectors
- Affected entities
- @addai/entity-runtimenpm package with malicious code
The @addai/entity-runtime npm package contained embedded malicious code discovered via Amazon Inspector. Upon installation, the package runs a daemon that continuously polls a hardcoded Supabase project (syhzpqqvrplaqdipcymw.supabase.co) via the RPC endpoint runtime_pick_next_request to retrieve remotely-supplied job instructions.
The malicious code spawns AI agent binaries (Claude Code, Codex, Kimi, Gemini, Grok) in a pseudo-terminal on the victim's machine, with execution parameters (prompt, model, working directory, allowed tools) controlled entirely by the remote attacker. When the permissionMode field is set to bypassPermissions, the spawned agent is invoked with the --dangerously-skip-permissions flag, allowing arbitrary shell command execution without user interaction.
Additionally, on first run, the package modifies the user's global Claude configuration file (~/.claude/settings.json) to permanently disable the bypass-permissions safety dialog, affecting all future interactive Claude Code sessions on that machine—not just those spawned by the daemon. The package also reads and modifies Kimi configuration and PATH environment variables.
The cumulative effect is a persistent, remote-controlled backdoor granting the attacker host-level remote code execution through the AI agent tool loop, combined with permanent degradation of the user's local AI safety controls.
Indicators of compromise
- Packages
- @addai/entity-runtime
- Domains
- syhzpqqvrplaqdipcymw.supabase.co
Remediation
- Immediately uninstall @addai/entity-runtime from all systems
- Audit npm package.json and lock files for any presence of @addai/entity-runtime
- Review ~/.claude/settings.json and restore skipDangerousModePermissionPrompt to false or remove the setting
- Check ~/.kimi/config for unauthorized modifications and restore if necessary
- Review shell history and process logs for evidence of remote command execution via spawned AI agents
- Rotate any credentials or secrets that may have been exposed during the compromise window
- Monitor the hardcoded Supabase project (syhzpqqvrplaqdipcymw.supabase.co) for any ongoing polling or command activity
- Consider full system audit and credential rotation if the package was installed on production or sensitive systems
Sources
- GitHub Advisory GHSA-p295-mg4h-j8jc · GitHub Advisory Database
Cite this entry
"Malicious code in @addai/entity-runtime (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 6, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-addai-entity-runtime-npm-1qaa8u
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
npmCompromised packageMalicious commit - containedcritical
Malicious code in @wololasod/tiny-id (npm)
The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.
npmCompromised packageMalicious commit