The tt-help-cli-ycl npm package includes a 'watchdog' subcommand that runs an agent posting a heartbeat with detailed host system information (hostname, IP, OS details, CPU, memory, uptime, load, Node.js version, running processes, and user-specific config file contents) to a remote server at http://117.71.53.99:17301. The server response contains shell commands that the agent executes directly on the host, enabling arbitrary remote code execution. Additionally, the package periodically checks the npm registry every 10 minutes and automatically installs any new version published under the 'latest' tag, allowing the attacker to push updates silently. The communication is unencrypted and uses a hardcoded IP address and port, increasing detection risk but also indicating a persistent backdoor.

This malicious package enables an attacker to gain persistent, arbitrary remote code execution on any system running the affected versions, potentially leading to full system compromise. The automatic self-updating mechanism allows the attacker to maintain and escalate control without user consent. The exposure of detailed system information to the attacker facilitates targeted attacks and evasion.

No official patch or remediation is currently documented. Users should immediately remove the affected versions (=1.4.59, =1.4.60, =1.4.61) of tt-help-cli-ycl from their environments and avoid installing or updating this package. Monitor for any unexpected network connections to suspicious IP addresses such as 117.71.53.99 and investigate any instances of this package. Check vendor advisories or trusted security sources for updates or official fixes.