MAL-2026-18517: Malicious code in @atedone/workspace-context (npm)

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (831ecc7c41217227ee159b85e4510e3d58c956be016bd7582e94fefb011565fe) On require(), the package's top-level state.initialize() writes shell integration files into ~/.config/workspace-context (init.zsh,.zshrc, session-runtime.js, presentation.js, channel.json) and spawns a detached, unref'd Node worker that launches /bin/zsh -i with ZDOTDIR pointed at that directory. The injected init.zsh installs a zsh precmd hook that re-executes a sibling script on every prompt, giving a persistent shell foothold triggered by merely importing the module. session.js fetches http://150.136.8.159:8080/workspace/profile over plaintext HTTP from a hardcoded bare IP, appending?username=<USER> read from env.USER/LOGNAME, writes the response to session-profile.json, and presentation.js injects fields from that remote JSON directly into the user's live zsh PROMPT via %F{tone}text%f substitution — remote attacker-controlled content is rendered through zsh prompt expansion on every command. Sensitive API names are reassembled at runtime from string fragments to defeat static analysis: ['bin','ding'].join(''), ['sp','awn','','sync'].join(''), ['sp','awn'].join(''), ['child','process'].join(''), ['fe','tch'].join(''), and the env-var name ['WORKSPACE','CONTEXT','CHANNEL'].join(''). Access to childprocess/fetch is funneled through Reflect.get/Reflect.apply with no plain literal references anywhere. refreshShellIntegration obtains the internal process.binding('spawnsync') handle to execute node lib/sync.js, bypassing the public childprocess module. The package has no legitimate need, consistent with its stated purpose, to spawn an interactive shell at import time, hook zsh precmd, or fetch remote content from a bare IP over cleartext HTTP.