Loading npm security reports…

tt-help-cli-ycl@1.4.61: Malicious npm security report (Block) | LPM Firewall

registry / tt-help-cli-ycl / 1.4.61

tt-help-cli-ycl@1.4.61

TikTok user & video data scraper - extract ttSeller, verified, locationCreated from HTML source

OSV Malicious Advisory

scanned 10d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-12488 confirms this npm version as malicious. The package's `watchdog` subcommand runs a long-lived agent that POSTs a heartbeat to a configurable remote server (default advertised as http://117.71.53.99:17301) and executes commands returned by that server. `_buildHeartbeatBody` collects hostname, non-loopback LAN IP, OS platform/release/arch, CPU count, memory, uptime, load average, node version, the running child-process table, and the contents of...

Advisory

MAL-2026-12488

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in tt-help-cli-ycl (npm)

Details

The package's `watchdog` subcommand runs a long-lived agent that POSTs a heartbeat to a configurable remote server (default advertised as http://117.71.53.99:17301) and executes commands returned by that server. `_buildHeartbeatBody` collects hostname, non-loopback LAN IP, OS platform/release/arch, CPU count, memory, uptime, load average, node version, the running child-process table, and the contents of `~/.tt-help.json` (server, proxy, browser path, userId), then sends them to `${serverUrl}/api/watchdog/heartbeat`. The response `commands` array is passed unchanged to `spawn('sh', ['-c', cmd])` (or `cmd /c` on Windows) through ProcessManager.startCommand, giving the remote server arbitrary shell execution on the host running the agent. Independently, `startUpgradeChecker` polls the npm registry every 10 minutes and, on any version bump, runs `npm install -g tt-help-cli-ycl@latest` via `child_process.exec`, so any future publish to the `latest` dist-tag is installed unattended on every running agent. The default C2 host is a bare IPv4 address on a non-standard port with no TLS.

Decision reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

References

OSV advisory PACKAGE

Source & flagged code

6 flagged

src/cli/raw-sync.jsView file

Lines 1-26javascript

1/**

2 * raw-sync CLI 入口

3 *

4 * 启动 raw_jobs 同步与任务补充程序（独立子进程）。

5 */

6

7import { spawn } from "child_process";

8import { resolve, dirname } from "path";

High

Child Process

Package source references child process execution.

src/cli/raw-sync.jsView on unpkg · L6

9import { fileURLToPath } from "url";

10

11const __dirname = dirname(fileURLToPath(import.meta.url));

12const SCRIPT = resolve(__dirname, "..", "..", "scripts", "sync-raw-jobs.mjs");

13

14export function handleRawSync(parsed) {

15 const args = ["--db", parsed.rawSyncDb, "--archive", parsed.rawSyncArchive];

16

17 if (parsed.rawSyncInterval != null)

18 args.push("--interval", String(parsed.rawSyncInterval));

19 if (parsed.rawSyncLlm) args.push("--llm");

20 if (parsed.rawSyncOnce) args.push("--once");

21

22 console.error(`[raw-sync] 启动同步程序: ${SCRIPT}`);

23

24 const child = spawn(process.execPath, [SCRIPT, ...args], {

25 stdio: "inherit",

26 windowsHide: true,

src/cli/comments.jsView file

Lines 154-194javascript

154 const ps1Path = path.join(os.tmpdir(), `edge-mem-${Date.now()}.ps1`);

155 try {

156 let ps1Content;

157

src/lib/scroll-collector.jsView file

Lines 11-51javascript

11 if (!containerSelector) {

12 el = window;

13 } else {

14 el = document.querySelector(containerSelector);

15 if (!el) {

src/watchdog/upgrader.jsView file

Lines 44-84javascript

44 if (!resp.ok)

45 return {

46 current,

47 latest: "?",

48 hasUpdate: false,

49 error: `HTTP ${resp.status}`

scripts/run-explore.shView file

•path = scripts/run-explore.sh kind = build_helper sizeBytes = 4376 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/run-explore.shView on unpkg

src/watch/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = tt-help-cli-ycl@1.4.48 matchedIdentity = npm:dHQtaGVscC1jbGkteWNs:1.4.48 similarity = 0.864 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/watch/server.jsView on unpkg