MAL-2026-15914
Dashboard / Malicious Package / MAL-2026-15914
MAL-2026-15914
Summary: Malicious code in taskforge-9xv (npm)
Details: Source: amazon-inspector (1b03d2c3ed0eec654a85d7843b208bdca926027df8dac14aa881f50c21a08f40) The `taskforge` CLI, once configured with an origin URL via `taskforge setup --origin-server <url>`, fetches bytes from `<origin>/api/x-handler` and pipes them into a detached `node -` process (`spawn(process.execPath, ['-'], {detached:true,...})` with the response body written to stdin). There is no hash, signature, or shape verification — only a >100-byte length gate. The spawned worker records its PID and is respawned on version change, giving whoever controls the configured origin a persistent remote code-execution channel on the host: the served payload can be rotated at will. The package reinforces this shape with cover-story naming (`taskforge-9xv` with a random suffix, description 'Runtime delivery client (private data layout)'), single-letter/renamed identifiers (`edap`, `dRB`, `esd`, `gapid`, `dl`, `spn`, `sPid`), a randomized 8-byte-hex data directory under `~/.local/share/taskforge/`, and a README stating the directory and filenames are intentionally not descriptive. The origin is caller-supplied rather than hardcoded, but the delivered code runs unchecked in the background regardless of who operates that origin.
Affected packages
Package
Name: taskforge-9xv
Purl: pkg:npm/taskforge-9xv
Affected ranges
Type: N/A
Events:
