@atedone/workspace-context@0.0.23
Workspace shell session refresh integration helper for JavaScript tools.
AI Security Review
scanned 2d ago · by lpm-firewall-aiImport automatically trusts profile data from a hard-coded plain HTTP endpoint and exposes its text to zsh command substitution. That gives the remote endpoint a direct path to execute commands in the user's shell.
Static reason
No blocking static signals were detected.
Trigger
Importing the package initializes integration and starts a preview shell; its prompt refresh hook runs automatically.
Impact
The endpoint can supply prompt text that runs commands in the user's shell; the request also exposes the local username in its URL.
Mechanism
The package fetches JSON from a hard-coded HTTP endpoint, stores it as a profile, and places its segment text into PROMPT while zsh prompt_subst is enabled.
Attack narrative
On import, the package initializes a preview shell and fetches a profile from a hard-coded HTTP endpoint. It saves the returned JSON, then renders its segment text into the zsh prompt. Because the installed hook enables prompt_subst, endpoint supplied text can trigger shell command substitution each time the prompt refreshes. The request also sends the local username in its URL.
AI rationale
Import automatically trusts profile data from a hard-coded plain HTTP endpoint and exposes its text to zsh command substitution. That gives the remote endpoint a direct path to execute commands in the user's shell.
Evidence
index.jslib/state.jslib/default-profile.jsonlib/session.jslib/sync.jslib/presentation.js<projectRoot>/.workspace-context/state.json<HOME>/.config/workspace-context/init.zsh<HOME>/.config/workspace-context/session-runtime.js<HOME>/.config/workspace-context/presentation.js<HOME>/.config/workspace-context/session-profile.json
Network endpoints1
150.136.8.159:8080/workspace/profile
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- Importing index.js immediately calls initialize(), which writes project state and starts shell integration and a preview session.
- The default profile channel uses plain HTTP at 150.136.8.159:8080/workspace/profile.
- The channel URL includes the local USER or LOGNAME as a username query parameter.
- The response is parsed as JSON and saved as the session profile snapshot.
- Profile segment text is inserted into the generated prompt without escaping shell prompt substitutions.
- The installed zsh hook enables prompt_subst and refreshes the prompt automatically.
Evidence against
- The package describes itself as a shell session refresh helper, and profile synchronization is part of that stated purpose.
- Users can override the channel URL through WORKSPACE_CONTEXT_CHANNEL or the refresh API.
Behavioral surface
Filesystem
HighEntropyStrings
Source & flagged code
9 flaggedlib/sync.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
lib/sync.js#virtual:normalized:round1View on unpkgindex.jsView file
3const state = require('./lib/state');
const initialized = state.initialize();
module.exports = {
initialized,
refresh: state.initialize,
channelFileName: state.channelFileN
High
Ai Review Evidence
Importing index.js immediately calls initialize(), which writes project state and starts shell integration and a preview session.
index.jsView on unpkg · L3lib/state.jsView file
Findings
9 High2 Low
HighSemantic Analysis Limitedlib/sync.js#virtual:normalized:round1
HighAi Review Evidenceindex.js
HighAi Review Evidencelib/state.js
HighAi Review Evidencelib/default-profile.json
HighAi Review Evidencelib/state.js
HighAi Review Evidencelib/session.js
HighAi Review Evidencelib/session.js
HighAi Review Evidencelib/presentation.js
HighAi Review Evidencelib/sync.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @atedone/workspace-context@0.0.23.
See all versions of @atedone/workspace-context for other recorded verdicts.
- Avoid installing @atedone/workspace-context@0.0.23. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.