Malicious code in @yancyyu/agentcli (npm)

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

The npm package `@yancyyu/agentcli` ships a Feishu/Lark credential stealer. An auto-started telemetry worker (`src/main/telemetry/worker.ts`, started via `agentcli init`/`agentcli usage start` and macOS launchd) calls `safeScanLarkCredentials()` in its periodic run loop; the scan reads and decrypts local Lark credentials (macOS Keychain AES-256-GCM `.enc` under `~/Library/Application Support/lark-cli/`, Windows DPAPI under `HKCU\Software\LarkCli\keychain`), refreshes tokens and POSTs {app_id, app_secret, access_token, refresh_token} to the operator backend (endpoint `/api/v1/report/lark-credentials`, later renamed `/api/v1/feishu/lark-cli/credentials`; default cloud hosts include `agentbus.skg.com`, `159.75.231.98:8088`, `47.112.24.153`). These versions are not part of the existing OSV record MAL-2026-11123 (Amazon Inspector), which covers 1.9.25-1.9.80. The true malicious boundary is 1.9.9 (2026-07-12) via the import->call reachability chain (`telemetry/worker.ts` -> `larkCredentials`), 16 versions earlier than the previously-catalogued 1.9.25; the reachable credential theft is present continuously across 1.9.9-1.9.24 (each verified) and 1.10.0. Versions 1.8.8-1.9.8 exfiltrate local Claude/Codex conversations to the same backend but do not yet steal Lark credentials (out of scope for this malware record). This report extends the confirmed-malicious set with 17 additional versions and an earlier boundary, scoped to the versions not yet listed in MAL-2026-11123 to avoid duplication. Determined by static code and dataflow review of the published npm tarballs. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7f6774653f487db8fbb9b40f1c1aba2bf959edffae409445162b0d245a3bedf1) The @yancyyu/agentcli package installs a telemetry worker (dist/telemetry-worker.bundle.mjs) that is started by `agentcli init` / `agentcli usage start` and auto-started via macOS launchd. The worker enumerates every lark-cli (Feishu) profile stored on the host — decrypting macOS Keychain-wrapped AES-256-GCM `.enc` files under `~/Library/Application Support/lark-cli/` and Windows DPAPI-protected values under `HKCU\Software\LarkCli\keychain` — refreshes each token, and batch-POSTs `{app_id, app_secret, access_token, refresh_token}` for every profile every 5 minutes to a hardcoded default endpoint `http://47.112.24.153` (plain HTTP, bare IPv4, no TLS). The endpoint constant `DEFAULT_OPENHERMIT_CLOUD_BASE_URL` is the single default for the credential batch upload and conversation/usage pipelines when no override env var or settings value is present. The enumeration is not limited to AgentCli-created profiles; every lark-cli profile on the machine is harvested. The `reportAllLarkCredentials` code comment states: "enumerate all personal lark-cli profiles, refresh each, then read current credentials [...] batch the complete eligible set to the server." The postinstall step additionally rewrites the optional `cc-connect` dependency's installer to prepend third-party China GitHub mirror hosts (gh-proxy.com, ghproxy.net) in front of upstream release URLs before the cc-connect native binary is downloaded and executed, broadening the trust boundary for that binary. Feishu (Lark) `app_id` + `app_secret` combined with valid access/refresh tokens allow full impersonation of the affected tenant applications; sending them cleartext to a bare IPv4 over HTTP additionally exposes them to any on-path observer.

Source published

28 Jul 2026 13:30:51 UTC

Source modified

11 Sep 2026 04:00:06 UTC

Saved here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.