{"id":"MAL-2026-18517","kind":"package","aliases":["MAL-2026-18517"],"related":[],"title":"Malicious code in @atedone/workspace-context (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (831ecc7c41217227ee159b85e4510e3d58c956be016bd7582e94fefb011565fe)\nOn require(), the package's top-level state.initialize() writes shell integration files into ~/.config/workspace-context (init.zsh,.zshrc, session-runtime.js, presentation.js, channel.json) and spawns a detached, unref'd Node worker that launches `/bin/zsh -i` with ZDOTDIR pointed at that directory. The injected init.zsh installs a zsh precmd hook that re-executes a sibling script on every prompt, giving a persistent shell foothold triggered by merely importing the module. session.js fetches http://150.136.8.159:8080/workspace/profile over plaintext HTTP from a hardcoded bare IP, appending?username=<USER> read from env.USER/LOGNAME, writes the response to session-profile.json, and presentation.js injects fields from that remote JSON directly into the user's live zsh PROMPT via %F{tone}text%f substitution — remote attacker-controlled content is rendered through zsh prompt expansion on every command. Sensitive API names are reassembled at runtime from string fragments to defeat static analysis: ['bin','ding'].join(''), ['sp','awn','_','sync'].join(''), ['sp','awn'].join(''), ['child','_process'].join(''), ['fe','tch'].join(''), and the env-var name ['WORKSPACE','_CONTEXT','_CHANNEL'].join(''). Access to child_process/fetch is funneled through Reflect.get/Reflect.apply with no plain literal references anywhere. refreshShellIntegration obtains the internal process.binding('spawn_sync') handle to execute `node lib/sync.js`, bypassing the public child_process module. The package has no legitimate need, consistent with its stated purpose, to spawn an interactive shell at import time, hook zsh precmd, or fetch remote content from a bare IP over cleartext HTTP.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@atedone/workspace-context","fixed":[],"affected":"= 0.0.23; = 0.0.14; = 0.0.25; = 0.0.22; = 0.0.20; = 0.0.15; = 0.0.19; = 0.0.13; = 0.0.12; = 0.0.18; = 0.0.21; = 0.0.24; = 0.0.16; = 0.0.17","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T04:36:25+00:00","first_seen_at":"2026-11-03T05:47:51+00:00","triaged_at":"2026-11-03T05:49:41+00:00","updated_at":"2026-11-03T05:50:50+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18517':8A,11A '-2026':7A,10A '/.config/workspace-context':43C '/bin/zsh':59C '/logname,':114C '/reflect.apply':205C '150.136.8.159':98C '8080/workspace/profile':99C '831ecc7c41217227ee159b85e4510e3d58c956be016bd7582e94fefb011565fe':28C 'access':196C 'amazon':26C 'amazon-inspector':25C 'analysi':169C 'anywher':211C 'api':157C 'append':108C 'atedone/workspace-context':4A,12A 'attack':144C 'attacker-control':143C 'awn':174C,178C 'bare':106C,258C 'bin':170C 'bypass':224C 'channel':194C 'channel.json':48C 'child':180C,198C,227C 'cleartext':261C 'code':2A 'command':155C 'consist':236C 'content':146C,255C 'context':193C 'control':145C 'd':54C 'defeat':167C 'detach':52C 'detail':17C 'ding':171C 'direct':128C 'directori':66C 'edit':20C 'env':189C 'env-var':188C 'env.user':113C 'env.user/logname,':112C 'everi':83C,154C 'execut':78C,221C 'expans':152C 'f':137C,140C 'fe':183C 'fetch':97C,253C 'field':123C 'file':41C 'foothold':89C 'fragment':165C 'funnel':201C 'give':85C 'handl':219C 'hardcod':105C 'hook':74C,249C 'http':102C,262C 'import':93C,247C 'init.zsh':44C,69C 'inject':68C,122C 'inspector':27C 'instal':70C 'integr':40C 'interact':244C 'intern':215C 'ip':107C,259C 'join':172C,176C,179C,182C,185C,195C 'json':127C 'launch':58C 'legitim':234C 'level':36C 'lib/sync.js':223C 'line':23C 'liter':209C 'live':133C 'mal':6A,9A 'malici':1A,13B 'mere':92C 'modul':95C,229C 'name':158C,191C 'need':235C 'node':55C,222C 'npm':5A 'obtain':213C 'packag':14B,32C,231C 'per':15C 'persist':87C 'plain':208C 'plaintext':101C 'point':63C 'precmd':73C,251C 'presentation.js':47C,121C 'process':181C,228C 'process.binding':216C 'process/fetch':199C 'prompt':84C,135C,151C 'public':226C 'purpos':240C 're':77C 're-execut':76C 'read':110C 'reassembl':160C 'refer':210C 'reflect.get':204C 'reflect.get/reflect.apply':203C 'refreshshellintegr':212C 'remot':126C,142C,254C 'render':148C 'requir':30C 'respons':117C 'runtim':162C 'script':81C 'sensit':156C 'session-profile.json':119C 'session-runtime.js':46C 'session.js':96C 'shell':39C,88C,245C 'sibl':80C 'sourc':16C,24C 'sp':173C,177C 'spawn':50C,217C,242C 'state':239C 'state.initialize':37C 'static':168C 'string':164C 'substitut':141C 'sync':175C,218C 'tch':184C 'text':139C 'time':248C 'tone':138C 'top':35C 'top-level':34C 'trigger':90C 'unref':53C 'user':131C 'usernam':109C 'var':190C 'via':136C 'worker':56C 'workspac':192C 'write':38C,115C 'zdotdir':62C 'zsh':72C,134C,150C,250C 'zshrc':45C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["workspacecontext"],"ptokens":["atedone","context","workspace"],"labels":["critical","malicious","npm","package"],"first_public_at":"2026-11-03T04:36:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18517","url":"https://osv.dev/vulnerability/MAL-2026-18517","severity":"critical","published_at":"2026-11-03T04:36:25+00:00","modified_at":"2026-11-03T05:15:05+00:00","first_seen_at":"2026-11-03T05:47:51+00:00","fetched_at":"2026-11-03T05:47:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}