{"id":"MAL-2026-18517","url":"https://compromised.live/t/MAL-2026-18517","kind":"compromised_package","tier":1,"severity":"critical","title":"Malicious code in @atedone/workspace-context (npm)","summary":"The npm package contains malicious code that can run on a developer's machine and may let an attacker take over the system or steal data. The npm package @atedone/workspace-context, including versions 0.0.14 through 0.0.25 such as 0.0.15, 0.0.20, 0.0.22, 0.0.23, and 0.0.25. Remove the package from projects, pin away from these versions, and check for signs of compromise such as unexpected processes or credential changes.","summary_source":"ai","affected":[{"ecosystem":"npm","package":"@atedone/workspace-context","affected":"0.0.23, 0.0.14, 0.0.25, 0.0.22, 0.0.20, 0.0.15, 0.0.19, 0.0.13, 0.0.12, 0.0.18, 0.0.21, 0.0.24, 0.0.16, 0.0.17","fixed":[]}],"epss":null,"kev":null,"first_seen":"2026-11-03T22:10:45.281Z","updated_at":"2026-11-03T22:10:45.281Z","status":"active","details":"","aliases":["MAL-2026-18517"],"sources":[{"name":"osv","id":"MAL-2026-18517","url":"https://osv.dev/vulnerability/MAL-2026-18517"}]}