Malicious npm package @atedone/workspace-context hijacks zsh via precmd hook and C2 prompt injection
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub advisory GHSA-39ch-q3p3-3j33 (published 2026-11-03, credited to OpenSSF/amazon-inspector) flags every published version (0.0.12–0.0.25) of the npm package @atedone/workspace-context as malware with no patched versions. On require(), the package writes shell integration files to ~/.config/workspace-context, spawns a detached Node worker launching /bin/zsh -i with ZDOTDIR pointed there, and installs a zsh precmd hook that re-executes a script on every prompt — a persistent foothold from merely importing the module. It fetches attacker-controlled JSON over plaintext HTTP from hardcoded IP 150.136.8.159:8080 (appending the local username) and injects it into the live zsh PROMPT. APIs are obfuscated via string-fragment joins and Reflect.get/Reflect.apply, and process.binding('spawnsync') bypasses childprocess. Anyone who installed the package is affected; there is no fix — remove it and clean the shell persistence.
What to do
- Remove @atedone/workspace-context from all projects and lockfiles immediately; treat any machine where it was installed as compromised
- Delete ~/.config/workspace-context and inspect ~/.zshrc, ZDOTDIR settings, and zsh precmd hooks for persistence
- Rotate credentials and secrets accessible from affected user accounts and review outbound connections to 150.136.8.159:8080
- Audit environments for the WORKSPACE_CONTEXT_CHANNEL env var and any spawned node/zsh processes
- Block the C2 IP 150.136.8.159 at network egress and hunt for the username-exfiltration HTTP pattern
Sources
All live incidents on Threat Watch
