workbuddy-checkin

This PowerShell wrapper appears to implement the intended automation of a WorkBuddy daily check-in without obvious malicious behaviors in the visible fragment (no persistence/backdoor behaviors, no suspicious extra network destinations, and no token logging). The main security concern is supply-chain/tampering risk: it executes a local helper (decrypt-token.js) under Node/Electron selected via environment/path probing, and then uses the resulting access token to authenticate to remote APIs. If decrypt-token.js or the selected runtimes are compromised, this wrapper would facilitate credential theft/exfiltration beyond its intended check-in function.

This fragment is high-risk from a supply-chain and automation perspective: it dynamically downloads and stages a full Electron runtime from npm at execution time, runs an Electron-based decryptor to obtain a token from stdout, and proceeds to automate a check-in workflow with `powershell -ExecutionPolicy Bypass` and scheduling guidance consistent with persistence/recurrence. No explicit exfiltration or overt malware payload is shown in the snippet alone, but the combination of token-handling + runtime code execution + reduced auditing/provenance (silent error suppression and deletion of npm artifacts) warrants urgent review of `$DecryptJs` and `$CheckinPs1`, and verification of npm artifact integrity/pinning in the broader build/deployment process.

This script is primarily an environment/runtime detector and token-decryption validator for WorkBuddy. No explicit malware behaviors (e.g., reverse shells, credential theft, or network exfiltration) are evident in this fragment. The main security concern is the optional auto-download-and-execute of electron@37 from the npm registry (without integrity verification or pinning in this script), which is a high-impact supply-chain trust expansion because the downloaded runtime is then used to execute the token decryption helper.

This module is highly suspicious: it enumerates local WorkBuddy/CodeBuddy authentication storage, decrypts protected legacy session data when possible, extracts an accessToken, and outputs it in plaintext to stdout using a deterministic marker. Even without network activity, printing credentials enables downstream exfiltration or account takeover. The hardcoded, targeted storage keys and multi-format recovery paths further indicate intent to harvest tokens reliably.