The forge-jsx npm package is a malicious software package impersonating an Autodesk Forge SDK. From its initial release on April 7, 2026, it functions as a remote access trojan (RAT) that installs a persistent background agent on infected machines. This agent captures keystrokes, monitors clipboard data, scans for .env files, reads shell history, and opens a WebSocket-based remote filesystem backdoor. Persistence mechanisms include systemd on Linux, LaunchAgent on macOS, and Task Scheduler on Windows. The stolen data is exfiltrated to the IP address 204.10.194.247. Removal of the package does not guarantee full remediation due to potential deeper system compromise.