MalwarePublished 23 Jun 2026Updated 26 Jun 2026

ttal2ttml (npm) · Malicious Code

Affects ttal2ttmlSource GCVE Database

Malicious package : remove ttal2ttml and rotate any secrets on hosts that installed it.

Data as of 26 Jun 2026, 22:33 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6298

What to do

Remove ttal2ttml from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmttal2ttml	Affected 1.0.4 – 99.0.3 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package ttal2ttml contains malicious code that executes a remote JavaScript payload during installation. This payload is fetched from an untrusted external domain and executed silently, potentially compromising the installing system. The package versions 1.0.4, 99.0.1, 99.0.2, and 99.0.3 are affected. The malicious behavior includes running arbitrary code with the installer's user privileges, which can lead to full system compromise. Removal of the package does not guarantee full remediation due to possible persistence of malicious artifacts.

Impact

Systems that install or run the affected ttal2ttml package versions are at risk of full compromise due to arbitrary remote code execution during package installation. Attackers can execute any code with the privileges of the user running npm install, potentially leading to theft of secrets, keys, and persistent backdoors. Because the malicious payload is fetched and executed dynamically, the attacker can change the payload at will. Even after package removal, the system may remain compromised if the attacker established persistence.

Defensive guidance

Users should immediately remove the ttal2ttml package versions =1.0.4, =99.0.1, =99.0.2, and =99.0.3 from their systems. All secrets and keys stored on affected machines should be rotated from a trusted, uncompromised environment. Due to the high risk of full system compromise, affected systems should be considered fully compromised and undergo thorough incident response and remediation. Monitor for any suspicious activity and avoid installing this package until a trusted version is released.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Jun 2026, 22:33 UTC

Technical details

References

Community reviews