@atedone/workspace-context@0.0.24
Workspace shell session refresh integration helper for JavaScript tools.
AI Security Review
scanned 2d ago · by lpm-firewall-aiImport automatically launches a preview shell that fetches profile content from a hard-coded HTTP endpoint and inserts server-controlled text into an active Zsh prompt without escaping. With prompt substitution enabled, crafted response text can execute shell commands.
Static reason
No blocking static signals were detected.
Trigger
Importing the package starts initialization, which opens a preview shell and synchronizes the default profile channel.
Impact
The remote endpoint can run shell commands in the spawned process with the inherited environment and user privileges. The package also sends the OS username in the request URL.
Mechanism
The HTTP response is saved as a profile; presentation segment text is interpolated into the prompt without escaping while Zsh prompt substitution is active, allowing command substitutions in the response to execute.
Attack narrative
Importing the package automatically starts a preview shell and fetches a profile from a hard-coded plaintext HTTP endpoint, including the OS username in the request. Returned presentation text is inserted unescaped into a Zsh prompt with prompt substitution enabled. A server response containing a command substitution can therefore execute shell commands in the spawned process, which inherits the caller's environment.
AI rationale
Import automatically launches a preview shell that fetches profile content from a hard-coded HTTP endpoint and inserts server-controlled text into an active Zsh prompt without escaping. With prompt substitution enabled, crafted response text can execute shell commands.
Evidence
index.jslib/state.jslib/default-profile.jsonlib/session.jslib/session-worker.jslib/sync.jslib/presentation.js.workspace-context/state.json~/.config/workspace-context/init.zsh~/.config/workspace-context/session-profile.json~/.config/workspace-context/session-runtime.js~/.config/workspace-context/presentation.js
Network endpoints1
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- Importing index.js immediately calls initialize(), which starts shell integration and a workspace session.
- The default profile channel is an HTTP endpoint at 150.136.8.159:8080/workspace/profile; the current OS username is appended to its query string.
- The session code fetches JSON from the channel and saves the returned profile locally.
- A spawned interactive shell inherits the process environment and runs the package's shell integration.
- Remote presentation text is inserted into the Zsh prompt without escaping, while prompt_subst is enabled and the prompt is generated through command substitution.
Evidence against
- package.json has no lifecycle scripts.
- The README describes profile-channel synchronization as the package's purpose and says a bundled channel is selected by default.
Behavioral surface
Filesystem
HighEntropyStrings
Source & flagged code
9 flaggedlib/sync.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
lib/sync.js#virtual:normalized:round1View on unpkgindex.jsView file
3const state = require('./lib/state');
const initialized = state.initialize();
module.exports = {
initialized,
High
Ai Review Evidence
Importing index.js immediately calls initialize(), which starts shell integration and a workspace session.
index.jsView on unpkg · L3lib/state.jsView file
Findings
9 High2 Low
HighSemantic Analysis Limitedlib/sync.js#virtual:normalized:round1
HighAi Review Evidenceindex.js
HighAi Review Evidencelib/state.js
HighAi Review Evidencelib/default-profile.json
HighAi Review Evidencelib/state.js
HighAi Review Evidencelib/session.js
HighAi Review Evidencelib/session-worker.js
HighAi Review Evidencelib/sync.js
HighAi Review Evidencelib/presentation.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @atedone/workspace-context@0.0.24.
See all versions of @atedone/workspace-context for other recorded verdicts.
- Avoid installing @atedone/workspace-context@0.0.24. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.