MAL-2026-12488

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (5246f6fbb6e6d46a9a9cab000fb5e2c2f2816831f9df67f64803054c92423963) The package's `watchdog` subcommand runs a long-lived agent that POSTs a heartbeat to a configurable remote server (default advertised as http://117.71.53.99:17301) and executes commands returned by that server. `_buildHeartbeatBody` collects hostname, non-loopback LAN IP, OS platform/release/arch, CPU count, memory, uptime, load average, node version, the running child-process table, and the contents of `~/.tt-help.json` (server, proxy, browser path, userId), then sends them to `${serverUrl}/api/watchdog/heartbeat`. The response `commands` array is passed unchanged to `spawn('sh', ['-c', cmd])` (or `cmd /c` on Windows) through ProcessManager.startCommand, giving the remote server arbitrary shell execution on the host running the agent. Independently, `startUpgradeChecker` polls the npm registry every 10 minutes and, on any version bump, runs `npm install -g tt-help-cli-ycl@latest` via `child_process.exec`, so any future publish to the `latest` dist-tag is installed unattended on every running agent. The default C2 host is a bare IPv4 address on a non-standard port with no TLS.