taskforge-9xv

{"modified":"2026-09-04T05:21:00Z","published":"2026-09-04T05:21:00Z","schema_version":"1.7.4","id":"MAL-2026-15914","summary":"Malicious code in taskforge-9xv (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1b03d2c3ed0eec654a85d7843b208bdca926027df8dac14aa881f50c21a08f40)\nThe `taskforge` CLI, once configured with an origin URL via `taskforge setup --origin-server <url>`, fetches bytes from `<origin>/api/x-handler` and pipes them into a detached `node -` process (`spawn(process.execPath, ['-'], {detached:true,...})` with the response body written to stdin). There is no hash, signature, or shape verification — only a >100-byte length gate. The spawned worker records its PID and is respawned on version change, giving whoever controls the configured origin a persistent remote code-execution channel on the host: the served payload can be rotated at will. The package reinforces this shape with cover-story naming (`taskforge-9xv` with a random suffix, description 'Runtime delivery client (private data layout)'), single-letter/renamed identifiers (`edap`, `dRB`, `esd`, `gapid`, `dl`, `spn`, `sPid`), a randomized 8-byte-hex data directory under `~/.local/share/taskforge/`, and a README stating the directory and filenames are intentionally not descriptive. The origin is caller-supplied rather than hardcoded, but the delivered code runs unchecked in the background regardless of who operates that origin.\n","affected":[{"package":{"ecosystem":"npm","name":"taskforge-9xv"},"versions":["1.3.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/bin.js","sha256":"eef4a0dd00495b9fb1361cfb9a7cfc28fab983a3fb0f0b8061255b450c3a8f7b","tlsh":"c8510f4a1af71835413734aa4b5fe00531b9991327cced98be1c93a4ff91835daa2b8d"},{"path":"package.json","sha256":"365595d068ec22d0352742b884a3e0578bbb49fbaed8fe5d36f24321708ea696","tlsh":"3ff0e528d8785d6310c86e64dd695243a630ce8b091d7c1ab7d700ac0f9da7761bd78d"}],"package_integrity":[{"filename":"taskforge-9xv-1.3.0.tgz","hashes":{"sha1":"9634126a470a80265841fd9d218585bb1e417359","sha512_sri":"sha512-oteF9wD6pe5sLKwEtyYnxFxNZ04nOyX7JxxVh5YGVrnfnN9wDRvX17GbKxj2RavxuWNl0WCsWKxwQo388sfn8A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/taskforge-9xv/v/1.3.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019483","import_time":"2026-09-04T05:39:33.195674466Z","modified_time":"2026-09-04T05:21:00Z","sha256":"1b03d2c3ed0eec654a85d7843b208bdca926027df8dac14aa881f50c21a08f40","source":"amazon-inspector","versions":["1.3.0"]}]}}