Malicious code in tt-help-cli-ycl (npm)
The npm package tt-help-cli-ycl contained malicious code that implemented a remote command execution agent. The package's watchdog subcommand established persistent connections to a hardcoded remote server (117.71.53.99:17301), exfiltrated system and configuration data, and executed arbitrary shell commands sent by the attacker. Additionally, an auto-upgrade mechanism allowed the attacker to push new malicious versions without user confirmation.
- Disclosed
- Last updated
- Blast radius
- All systems with tt-help-cli-ycl installed globally or as a dependency
- Ecosystems
- Attack vectors
- Affected entities
- tt-help-cli-yclnpm package containing malicious watchdog agent
The npm package tt-help-cli-ycl contained a malicious tt-help watchdog subcommand that implemented a remote command execution agent. The agent established persistent connections to a hardcoded remote server at http://117.71.53.99:17301 and sent heartbeat requests every 15 seconds by default.
Each heartbeat exfiltrated sensitive host information including hostname, IPv4 address, OS details, CPU count, memory, Node.js version, uptime, load average, and the contents of ~/.tt-help.json (which contained server configuration, proxy settings, browser preferences, user IDs, and tuning parameters). This data was POSTed as JSON to the attacker's server.
The watchdog agent executed arbitrary shell commands returned by the remote server through child_process.spawn with shell=true, with automatic restart capability. Additionally, an upgrade checker polled the npm registry every 10 minutes and automatically installed new versions of tt-help-cli-ycl via npm install -g tt-help-cli-ycl@latest without user confirmation, allowing the attacker to push new malicious code to all running instances.
This combination of remote command execution, persistent host inventory collection, configuration exfiltration, and unattended auto-upgrade created a complete remote access trojan (RAT) capability.
Indicators of compromise
- Packages
- tt-help-cli-ycl
- IPs
- 117.71.53.99
Remediation
- Immediately uninstall tt-help-cli-ycl from all systems: npm uninstall -g tt-help-cli-ycl
- Audit ~/.tt-help.json files for any sensitive credentials or configuration that may have been exfiltrated
- Review system logs and process history for evidence of unauthorized command execution
- Block outbound connections to 117.71.53.99:17301 at the network level
- Scan systems for any persistence mechanisms or additional malware installed by the watchdog agent
- Verify the integrity of any systems that had tt-help-cli-ycl installed, as arbitrary code execution occurred
- Do not reinstall tt-help-cli-ycl or any related packages without verifying the publisher and code integrity
Sources
- GitHub Advisory GHSA-jh6x-h6j2-xw9v · GitHub Advisory Database
Cite this entry
"Malicious code in tt-help-cli-ycl (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-tt-help-cli-ycl-npm-1k8qyy
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in blekit (npm)
The npm package blekit contained malicious code that silently exfiltrated application logs, GPS coordinates, device identifiers, and security posture to an attacker-controlled Telegram channel. The package re-exported logger functions that POSTed all logged strings to Telegram, and exposed device-info helpers that gathered and transmitted precise location and device metadata without user or developer consent.
npmCompromised packageMalicious maintainer - activecritical
Malicious code in aclade-agent (npm)
The npm package aclade-agent contains malicious code that establishes a daemon polling a remote server (aclade.com) for arbitrary task execution, including bash commands, filesystem operations, and scheduled persistence. The package automatically updates itself globally, allowing any future compromise of the maintainer account to propagate automatically to all running instances.
npmCompromised packageMalicious maintainer - containedcritical
Malicious code in agenthub-ai (npm)
The npm package agenthub-ai contained malicious code that established a persistent WebSocket daemon connecting to a hardcoded remote server, enabling full host control including file operations, subprocess execution, and forced package updates. The package also used npm overrides to redirect Anthropic's native SDK bindings to a stub package under a different maintainer, creating a supply chain pivot point.
npmCompromised packageMalicious maintainer - resolvedcritical
Malicious code in @lyxa.ai/core (npm)
The npm package @lyxa.ai/core contained malicious code that unconditionally routes all application events through author-controlled cloud infrastructure (CloudAMQP, Redis Cloud, GCP) using embedded credentials, and ships live private keys for GCP and Firebase services, allowing the author to intercept, modify, and trigger arbitrary handlers in any installer's process.
npmAI agents & skillsCompromised packageMalicious maintainer