Malicious code in @yane88/workbuddy (npm)

The @yane88/workbuddy npm package (versions 1.0.0 to 1.0.3) uses a postinstall script to download three sibling npm packages containing parts of a split PKWARE ZIP archive. These parts (.z01, .z02, .zip) are concatenated and decompressed to produce a Windows PE executable (WorkBuddy-5.3.5.exe) written into the package directory with executable permissions. This technique of splitting a binary payload across multiple packages and reassembling it at install time is a known delivery pattern for opaque malware and is not a standard npm native-addon or prebuild-install process. There is no verification of the payload integrity or transparency about its purpose, indicating malicious intent. The package compromises the host system, potentially granting full control to an attacker.

Any system with the affected versions of @yane88/workbuddy installed is considered fully compromised. The malicious payload can lead to complete system takeover, exposing all stored secrets and keys. Attackers may have persistent access beyond the package removal, making remediation difficult without full system recovery and credential rotation.

Immediate removal of the @yane88/workbuddy package versions 1.0.0 through 1.0.3 is recommended. However, since the system may be fully compromised, all secrets and keys stored on the affected computer must be rotated from a separate, trusted system. No official patch or fix is available; the package itself is malicious. Users should audit their systems for persistence mechanisms and consider full system reimaging if compromise is suspected.