MAL-2026-15914 Malicious code in taskforge-9xv (npm)

The taskforge CLI, once configured with an origin URL via taskforge setup --origin-server <url>, fetches bytes from <origin>/api/x-handler and pipes them into a detached node - process (spawn(process.execPath, ['-'], {detached:true,...}) with the response body written to stdin). There is no hash, signature, or shape verification — only a >100-byte length gate. The spawned worker records its PID and is respawned on version change, giving whoever controls the configured origin a persistent remote code-execution channel on the host: the served payload can be rotated at will. The package reinforces this shape with cover-story naming (taskforge-9xv with a random suffix, description 'Runtime delivery client (private data layout)'), single-letter/renamed identifiers (edap, dRB, esd, gapid, dl, spn, sPid), a randomized 8-byte-hex data directory under ~/.local/share/taskforge/, and a README stating the directory and filenames are intentionally not descriptive. The origin is caller-supplied rather than hardcoded, but the delivered code runs unchecked in the background regardless of who operates that origin.