⌘ + K

MAL-2026-12488

Dashboard / Malicious Package / MAL-2026-12488

MAL-2026-12488

Published: 5 Aug 2026Last Modified: 7 Aug 2026

Summary: Malicious code in tt-help-cli-ycl (npm)

Details: Source: amazon-inspector (e6144be61d70f258741e5d4cc1476021f93e3ce82ffa00a3f86189537a1438a6) The package's `tt-help watchdog` subcommand starts a long-running agent that POSTs heartbeats to a remote server (default hardcoded to http://117.71.53.99:17301, referenced in src/lib/constants.js and the README/run-explore examples) and executes commands returned in the response. In WatchdogAgent, syncCommands maps entries from the server's `commands` array into child_process.spawn(command, { shell: true }) via ProcessManager.startCommand, with auto-restart — the remote operator selects arbitrary shell commands to run on the installer's host. Each heartbeat body assembled by _buildHeartbeatBody carries hostname, non-internal IPv4 address, OS platform/release/arch, CPU count, memory, node version, uptime, load average, and the contents of ~/.tt-help.json (server, proxy, browser, userId, tuning fields), POSTed as JSON to ${serverUrl}/api/watchdog/heartbeat at the configured interval (default 15s). In addition, _startUpgradeChecker polls the npm registry every 10 minutes and, when a new version of tt-help-cli-ycl is published, invokes `npm install -g tt-help-cli-ycl@latest` via child_process.exec and re-spawns, so the publisher can push arbitrary new code to every running agent host without user confirmation. The combination of remote-command execution, ongoing host inventory + stored-config exfiltration to a bare-IP destination, and unattended auto-upgrade constitutes a full command-and-control backdoor rather than a legitimate remote-management tool.

Affected packages

Package

Name: tt-help-cli-ycl

Purl: pkg:npm/tt-help-cli-ycl

Affected ranges

Type: N/A

Events:

Introduced- None

Fixed -None

Affected versions

1.4.61

1.4.59

1.4.60

1.4.63

1.4.64

1.4.67

1.4.71

1.4.65

1.4.70

1.4.66

1.4.57

1.4.73

1.4.62

1.4.69

1.4.72

1.4.58

1.4.68

1.4.74

1.4.78

1.4.75

1.4.76