Malicious code in taskforge-8xv (npm)

The taskforge-8xv npm package (version 1.2.0) functions solely as a runtime loader that retrieves JavaScript payloads from a configured remote origin's /api/x-handler endpoint and executes them in memory by spawning a detached Node.js child process. It does not perform any signature or hash verification on the downloaded code, as explicitly stated in its README. The package employs evasion techniques such as storing state in random 8-byte hex subdirectories with pointer.json indirection, spawning the child process with windowsHide:true and ignored stdio streams, and terminating prior worker processes before each execution. The package lacks any legitimate library functionality and effectively grants full code execution on the host to the remote origin controller during any version-check poll.

An attacker controlling the configured remote origin can execute arbitrary JavaScript code on the host running taskforge-8xv version 1.2.0. This results in full code execution capabilities, potentially leading to complete system compromise. The malicious package's stealth features facilitate evasion of detection and persistent unauthorized access.

No official patch or remediation is currently documented. Users should immediately remove and cease use of taskforge-8xv version 1.2.0. Avoid installing or running this package, and verify dependencies to ensure it is not included transitively. Monitor for any updates from the package maintainer or npm advisories for remediation guidance.