MAL-2026-15913 Malicious code in taskforge-8xv (npm)

The package's sole function is a runtime loader that fetches a JavaScript payload from a configured origin's /api/x-handler endpoint and executes it in memory by piping the bytes into a detached node - child process (spawn(process.execPath, ["-"], {detached:true, stdio:["pipe","ignore","ignore"], windowsHide:true})). No signature or hash verification is performed and the README explicitly states client contents are not verified. Supporting evasion characteristics are present: state is kept in a random 8-byte hex subdirectory under the app-data root with a pointer.json indirection, the child is spawned detached with windowsHide:true and stdio ignored, a prior worker PID is SIGTERM'd before each execution, and the package documents that directory and internal filenames are intentionally non-descriptive. The package supplies no legitimate library functionality beyond executing remote code; whoever controls the configured origin obtains full code execution on the host during any version-check poll.