The npm package ttal2ttml declares a preinstall lifecycle script that runs a Node.js command to fetch and execute a remote JavaScript payload from an anonymous external domain (d1ugk469z93e.0ac.io) on every npm install. This execution happens silently with errors suppressed, allowing arbitrary code execution under the installer's user account. The package's nominal function (TTML conversion) does not require network access, indicating the network call is malicious. The package is published at artificially high versions (99.0.x) as a dependency-confusion research proof of concept but executes malicious code regardless. Affected versions are =1.0.4, =99.0.1, =99.0.2, and =99.0.3. The compromise risk includes full system control and potential exposure of secrets and keys stored on the affected machine.

Systems that install or run the affected ttal2ttml package versions are at risk of full compromise due to arbitrary remote code execution during package installation. Attackers can execute any code with the privileges of the user running npm install, potentially leading to theft of secrets, keys, and persistent backdoors. Because the malicious payload is fetched and executed dynamically, the attacker can change the payload at will. Even after package removal, the system may remain compromised if the attacker established persistence.

No official patch or fix is currently available. Users should immediately remove the ttal2ttml package versions =1.0.4, =99.0.1, =99.0.2, and =99.0.3 from their systems. All secrets and keys stored on affected machines should be rotated from a trusted, uncompromised environment. Due to the high risk of full system compromise, affected systems should be considered fully compromised and undergo thorough incident response and remediation. Monitor for any suspicious activity and avoid installing this package until a trusted version is released.