The npm package @atedone/workspace-context contains malicious code that executes upon import. It writes shell integration files to the user's home configuration directory and spawns a detached interactive zsh shell with a persistent hook that executes a script on every prompt. The package fetches remote content over unencrypted HTTP from a hardcoded IP address, injecting attacker-controlled data into the user's shell prompt, enabling remote code execution via prompt expansion. The code uses obfuscation techniques to hide its use of child process spawning and network fetching APIs. This behavior is unrelated to the package's stated purpose and represents a severe security risk.