taskforge-8xv

{"modified":"2026-09-04T05:20:43Z","published":"2026-09-04T05:20:43Z","schema_version":"1.7.4","id":"MAL-2026-15913","summary":"Malicious code in taskforge-8xv (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2b8c18d7b4343e4c1d39e62a7d19eb9c5a9b4beb369fde301103623c3a7f0651)\nThe package's sole function is a runtime loader that fetches a JavaScript payload from a configured origin's /api/x-handler endpoint and executes it in memory by piping the bytes into a detached `node -` child process (spawn(process.execPath, [\"-\"], {detached:true, stdio:[\"pipe\",\"ignore\",\"ignore\"], windowsHide:true})). No signature or hash verification is performed and the README explicitly states client contents are not verified. Supporting evasion characteristics are present: state is kept in a random 8-byte hex subdirectory under the app-data root with a pointer.json indirection, the child is spawned detached with windowsHide:true and stdio ignored, a prior worker PID is SIGTERM'd before each execution, and the package documents that directory and internal filenames are intentionally non-descriptive. The package supplies no legitimate library functionality beyond executing remote code; whoever controls the configured origin obtains full code execution on the host during any version-check poll.\n","affected":[{"package":{"ecosystem":"npm","name":"taskforge-8xv"},"versions":["1.2.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/bin.js","sha256":"eef4a0dd00495b9fb1361cfb9a7cfc28fab983a3fb0f0b8061255b450c3a8f7b","tlsh":"c8510f4a1af71835413734aa4b5fe00531b9991327cced98be1c93a4ff91835daa2b8d"},{"path":"src/identity.js","sha256":"7d0c230f0764ac45b7d6622fdadb6504d8e409b2e9d09c07170d8c703637a939","tlsh":"e931ae932bf32b688273e25e0b0fd0196179e8533609de68b50c87756f61134c362bbd"}],"package_integrity":[{"filename":"taskforge-8xv-1.2.0.tgz","hashes":{"sha1":"1c8c96b63082ecc65c64ea0a398146a1544e43eb","sha512_sri":"sha512-gQ+M9HjuZHw1J8J26xLeUjneXcj28Hj8BUclVW5HbAv9SM0mRa3e0lI0wnw8HRBs7gfori/MOBmJCS9ApFTKAg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/taskforge-8xv/v/1.2.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019481","import_time":"2026-09-04T05:39:33.061431641Z","modified_time":"2026-09-04T05:20:43Z","sha256":"2b8c18d7b4343e4c1d39e62a7d19eb9c5a9b4beb369fde301103623c3a7f0651","source":"amazon-inspector","versions":["1.2.0"]}]}}