⌘ + K

MAL-2026-11123

Dashboard / Malicious Package / MAL-2026-11123

MAL-2026-11123

Published: 28 Jul 2026Last Modified: 11 Sept 2026

Summary: Malicious code in @yancyyu/agentcli (npm)

Details: The npm package `@yancyyu/agentcli` ships a Feishu/Lark credential stealer. An auto-started telemetry worker (`src/main/telemetry/worker.ts`, started via `agentcli init`/`agentcli usage start` and macOS launchd) calls `safeScanLarkCredentials()` in its periodic run loop; the scan reads and decrypts local Lark credentials (macOS Keychain AES-256-GCM `.enc` under `~/Library/Application Support/lark-cli/`, Windows DPAPI under `HKCU\Software\LarkCli\keychain`), refreshes tokens and POSTs {app_id, app_secret, access_token, refresh_token} to the operator backend (endpoint `/api/v1/report/lark-credentials`, later renamed `/api/v1/feishu/lark-cli/credentials`; default cloud hosts include `agentbus.skg.com`, `159.75.231.98:8088`, `47.112.24.153`). These versions are not part of the existing OSV record MAL-2026-11123 (Amazon Inspector), which covers 1.9.25-1.9.80. The true malicious boundary is 1.9.9 (2026-07-12) via the import->call reachability chain (`telemetry/worker.ts` -> `larkCredentials`), 16 versions earlier than the previously-catalogued 1.9.25; the reachable credential theft is present continuously across 1.9.9-1.9.24 (each verified) and 1.10.0. Versions 1.8.8-1.9.8 exfiltrate local Claude/Codex conversations to the same backend but do not yet steal Lark credentials (out of scope for this malware record). This report extends the confirmed-malicious set with 17 additional versions and an earlier boundary, scoped to the versions not yet listed in MAL-2026-11123 to avoid duplication. Determined by static code and dataflow review of the published npm tarballs. Source: amazon-inspector (7f6774653f487db8fbb9b40f1c1aba2bf959edffae409445162b0d245a3bedf1) The @yancyyu/agentcli package installs a telemetry worker (dist/telemetry-worker.bundle.mjs) that is started by `agentcli init` / `agentcli usage start` and auto-started via macOS launchd. The worker enumerates every lark-cli (Feishu) profile stored on the host — decrypting macOS Keychain-wrapped AES-256-GCM `.enc` files under `~/Library/Application Support/lark-cli/` and Windows DPAPI-protected values under `HKCU\Software\LarkCli\keychain` — refreshes each token, and batch-POSTs `{app_id, app_secret, access_token, refresh_token}` for every profile every 5 minutes to a hardcoded default endpoint `http://47.112.24.153` (plain HTTP, bare IPv4, no TLS). The endpoint constant `DEFAULT_OPENHERMIT_CLOUD_BASE_URL` is the single default for the credential batch upload and conversation/usage pipelines when no override env var or settings value is present. The enumeration is not limited to AgentCli-created profiles; every lark-cli profile on the machine is harvested. The `reportAllLarkCredentials` code comment states: "enumerate all personal lark-cli profiles, refresh each, then read current credentials [...] batch the complete eligible set to the server." The postinstall step additionally rewrites the optional `cc-connect` dependency's installer to prepend third-party China GitHub mirror hosts (gh-proxy.com, ghproxy.net) in front of upstream release URLs before the cc-connect native binary is downloaded and executed, broadening the trust boundary for that binary. Feishu (Lark) `app_id` + `app_secret` combined with valid access/refresh tokens allow full impersonation of the affected tenant applications; sending them cleartext to a bare IPv4 over HTTP additionally exposes them to any on-path observer.

Affected packages

Package

Name: @yancyyu/agentcli

Purl: pkg:npm/%40yancyyu/agentcli

Affected ranges

Type: N/A

Events:

Introduced- None

Fixed -None

Affected versions

1.9.32

1.9.42

1.9.35

1.9.27

1.9.52

1.9.43

1.9.61

1.9.66

1.9.67

1.9.48

1.9.26

1.9.77

1.9.44

1.9.53

1.9.29

1.9.40

1.9.33

1.9.36

1.9.50

1.9.71

1.9.58

1.9.79

1.9.30

1.9.78

1.9.28

1.9.80

1.9.25

1.9.9

1.9.10

1.9.11

1.9.12

1.9.13

1.9.14

1.9.15

1.9.16

1.9.17

1.9.18

1.9.19

1.9.20

1.9.21

1.9.22

1.9.23

1.9.24