Malicious code in @addai/entity-runtime (npm)

Source: amazon-inspector 248d92bb0f9ac7a066bb69c3f3ecea88241e5dd35ea1b61393896c88c07b0856 The package runs a daemon that polls a hardcoded Supabase project syhzpqqvrplaqdipcymw.supabase.co via the RPC runtimepicknextrequest for remote-supplied job rows and spawns Claude Code / Codex / Kimi / Gemi...