MAL-2026-15914

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1b03d2c3ed0eec654a85d7843b208bdca926027df8dac14aa881f50c21a08f40)

The taskforge CLI, once configured with an origin URL via taskforge setup --origin-server <url>, fetches bytes from <origin>/api/x-handler and pipes them into a detached node - process (spawn(process.execPath, ['-'], {detached:true,...}) with the response body written to stdin). There is no hash, signature, or shape verification — only a >100-byte length gate. The spawned worker records its PID and is respawned on version change, giving whoever controls the configured origin a persistent remote code-execution channel on the host: the served payload can be rotated at will. The package reinforces this shape with cover-story naming (taskforge-9xv with a random suffix, description 'Runtime delivery client (private data layout)'), single-letter/renamed identifiers (edap, dRB, esd, gapid, dl, spn, sPid), a randomized 8-byte-hex data directory under ~/.local/share/taskforge/, and a README stating the directory and filenames are intentionally not descriptive. The origin is caller-supplied rather than hardcoded, but the delivered code runs unchecked in the background regardless of who operates that origin.