Malicious code in taskforge-9xv (npm)

The taskforge-9xv CLI, when configured with an origin URL via 'taskforge setup --origin-server <url>', fetches code from '<origin>/api/x-handler' and executes it in a detached Node.js process without any hash, signature, or structural verification, only requiring the payload to be larger than 100 bytes. The spawned process is persistent, respawning on version changes and recording its PID. This design allows whoever controls the configured origin server to execute arbitrary code persistently on the host. The package employs obfuscation through randomized directory names, non-descriptive identifiers, and misleading documentation to hide this behavior. The affected version is exactly 1.3.0.

An attacker who can control or influence the origin URL configured in taskforge-9xv can execute arbitrary code on the host system persistently and remotely. This effectively provides a remote code execution backdoor that can be updated dynamically by changing the payload served from the origin. There is no built-in verification of the fetched code, making the host fully trusting of the attacker-controlled origin.

No official patch or fix is currently documented. Users should avoid configuring taskforge-9xv with untrusted origin URLs. Given the lack of verification and the persistent remote code execution channel, the safest mitigation is to uninstall or avoid using version 1.3.0 of taskforge-9xv. Monitor for updates from the package maintainers or security advisories for any forthcoming patches.