registry / Credential exfiltration / @yancyyu/agentcli

@yancyyu/agentcli

AgentCli: AI 工程协作平台，本地优先的用量采集与团队协作工具。

This report shows the evidence for @yancyyu/agentcli@1.9.62. 48 of 50 known versions are blocked or flagged. The newest version, 1.10.0, is blocked. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Source establishes a concrete credential-exfiltration chain triggered by an ordinary product command and persisted through its worker. The authentication precondition does not provide informed consent for harvesting unrelated Lark credentials.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User runs `agentcli usage start` (or starts its usage worker).

Impact

Exposes Lark app secrets and access/refresh tokens to the configured AgentBus server.

Mechanism

credential harvesting and authenticated remote batch exfiltration

Attack narrative

The package's normal usage-start flow launches a foreground report and then a persistent worker. That worker enumerates Lark CLI profiles, decrypts locally stored app secrets and OAuth access/refresh tokens, and POSTs batches to AgentBus every five minutes. Reporting is not tied to the otherwise explicit conversation-upload toggle; only an existing AgentBus login gates transmission.

AI rationale

Evidence

bin/lib/usageCommand.mjsbin/lib/larkSecrets.mjssrc/main/telemetry/worker.tssrc/main/telemetry/larkCredentials.tssrc/shared/constants/cloudConfig.mjs~/Library/Application Support/lark-cli/*.encmacOS Keychain lark-cli entry~/.hermit/lark-credentials/status.json

Network endpoints1

47.112.24.153/api/v1/feishu/lark-cli/credentials/batch

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

src/main/telemetry/larkCredentials.ts decrypts lark-cli secrets from Keychain/DPAPI storage.
It POSTs app secret plus access/refresh tokens to /api/v1/feishu/lark-cli/credentials/batch.
bin/lib/usageCommand.mjs runs this credential report during ordinary `usage start`.
src/main/telemetry/worker.ts repeats Lark reporting on the five-minute worker cadence.
Default cloud target is cleartext http://47.112.24.153.

Evidence against

Lark upload requires an existing AgentBus bearer-token login.
Conversation-message upload has an explicit enable path, but Lark credential reporting does not.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

Source & flagged code

21 flagged

package.jsonView file

Lines 23-63json

23 "agentcli": "./bin/hermit.mjs"

24 },

25 "files": [

26 "bin/",

27 "scripts/report-lark-credentials-once.mjs",

28 "src/",

29 "dist-renderer/",

30 "vendor/cc-connect/",

31 "branding.json",

32 "tsconfig.json",

33 "package.json",

34 "README.md",

35 "README-CN.md"

36 ],

37 "scripts": {

38 "dev": "node ./scripts/dev-mvp.mjs",

39 "dev:server": "tsx watch src/main/server.ts",

40 "dev:web": "vite --config vite.web.config.ts",

41 "build:web": "vite build --config vite.web.config.ts --outDir ../../dist-renderer --emptyOutDir",

42 "build:pages": "node ./scripts/build-pages.mjs",

43 "postinstall": "node ./bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "prepack": "node ./scripts/fetch-vendor-cc-connect.mjs && pnpm build:web",

45 "fetch:vendor": "node ./scripts/fetch-vendor-cc-connect.mjs",

46 "release:checklist": "node ./scripts/release-checklist.mjs",

47 "start": "node bin/hermit.mjs",

48 "lark:report-once": "node scripts/report-lark-credentials-once.mjs",

49 "typecheck": "tsc --noEmit",

50 "lint": "eslint src/ --cache --cache-location .eslintcache --cache-strategy content",

51 "lint:fix": "eslint src/ --fix --cache --cache-location .eslintcache --cache-strategy content",

52 "format": "prettier --write \"src/**/*.{ts,tsx,js,jsx,json,css}\"",

53 "format:check": "prettier --check \"src/**/*.{ts,tsx,js,jsx,json,css}\"",

54 "test": "vitest run",

55 "test:watch": "vitest",

56 "test:coverage": "vitest run --coverage",

57 "prepare": "husky"

58 },

59 "lint-staged": {

60 "src/**/*.{ts,tsx,js,jsx}": [

61 "prettier --write"

62 ],

63 "src/**/*.{json,css}": [

bin/kill-dev.jsView file

1#!/usr/bin/env node L2: import { spawnSync } from 'child_process'; L3:

High

Child Process

Package source references child process execution.

bin/kill-dev.jsView on unpkg · L1

8stdio: 'inherit', L9: shell: true, L10: });

High

Shell

Package source references shell execution.

bin/kill-dev.jsView on unpkg · L8

bin/lib/navigationCommand.mjsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.57 matchedPath = bin/lib/navigationCommand.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.57 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/navigationCommand.mjsView on unpkg

138L139: const require = createRequire(import.meta.url); L140:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lib/navigationCommand.mjsView on unpkg · L138

bin/lib/teams.mjsView file

70if (!raw) return ''; L71: if (raw === '~') return os.homedir(); L72: if (raw.startsWith('~/')) return path.join(os.homedir(), raw.slice(2));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/lib/teams.mjsView on unpkg · L70

bin/lib/aikey.mjsView file

Lines 1-33javascript

1// aikey.mjs — CLI "认领 aikey" command + token-distribution config writer.

2//

3// Three distribution surfaces, the first two fed by the same provider→SDK-env-var map:

4// • applyToConfigs / applyClaimedSecret — the LIVE path: writes the gateway key

5// straight into ~/.claude/settings.json (env.ANTHROPIC_AUTH_TOKEN/BASE_URL +

6// tier model vars) and ~/.codex/{auth.json,config.toml}. Claude Code / Codex

7// read their key from their own config.

8// • ~/.hermit/aikey.env — a sourced env file kept as the "claimed" marker and as

9// a convenience for external agents (see runAikeyManual). It is never auto-

bin/lib/auth.mjsView file

380async function openExternalUrl(url) { L381: const mode = process.env.OPENHERMIT_AUTH_OPEN_BROWSER || process.env.OPENHERMIT_OAUTH_OPEN_BROWSER; L382: if (mode === '0') return { opened: false, skipped: true }; L383: if (mode === 'fetch') { L384: await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(30_000) }); L385: return { opened: true, mode: 'fetch' }; ... L390: // as a single argument, so query characters (& ? =) need no shell quoting. L391: // The previous powershell `Start-Process -FilePath $args[0]` form exited L392: // non-zero and the browser silently never opened on Windows.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/lib/auth.mjsView on unpkg · L380

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.57 matchedPath = bin/lib/auth.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.57 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/auth.mjsView on unpkg

src/main/services/hermitBridge/CcConnectBinaryFetcher.tsView file

29L30: import { execFileSync } from 'node:child_process'; L31: import { createHash } from 'node:crypto'; ... L50: L51: const DEFAULT_MIRROR_PREFIXES = ['https://gh-proxy.com/', 'https://ghproxy.net/']; L52: ... L60: function detectPlatformTarget(): PlatformTarget | null { L61: const platform = process.platform; // darwin | win32 | linux L62: const arch = process.arch; // x64 | arm64 ... L78: L79: /** Resolve the cc-connect version agentcli expects, from package.json. */ L80: function resolveExpectedVersion(): string | null {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/main/services/hermitBridge/CcConnectBinaryFetcher.tsView on unpkg · L29

bin/postinstall.mjsView file

1Install-time AI-agent control hijack evidence: L3: import { L4: copyFileSync, L5: cpSync, L6: existsSync, L7: mkdirSync, L8: readFileSync, ... L11: rmSync, L12: writeFileSync, L13: } from 'node:fs'; ... L48: const bundledWorkflowsDir = path.join(packageRoot, 'src/main/services/system-manager/builtin-workflows'); L49: const hermitWorkflowDir = path.join(hermitHome, '.claude', 'workflow'); L50: const builtinWorkflowMarker = ''; Payload evidence from src/renderer/features/CLAUDE.md: L1: # Renderer Features - Legacy Note L2:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall.mjsView on unpkg · L1

bin/lib/update.mjsView file

25function globalInstallCommand() { L26: return `npm install -g ${BRAND.npmPackage}@latest --registry=https://registry.npmjs.org/`; L27: } ... L38: 'for ($i = 0; $i -lt $attempts; $i++) {', L39: ` $proc = Start-Process -FilePath 'cmd.exe' -ArgumentList '/d','/s','/c','${installCommand}' -Wait -PassThru -WindowStyle Hidden`, L40: ' if ($proc.ExitCode -eq 0) { exit 0 }',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/lib/update.mjsView on unpkg · L25

vendor/cc-connect/darwin-amd64/cc-connectView file

•path = vendor/cc-connect/darwin-amd64/cc-connect kind = native_binary sizeBytes = 27504800 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/cc-connect/darwin-amd64/cc-connectView on unpkg

dist-renderer/icon.rarView file

•path = dist-renderer/icon.rar kind = high_entropy_blob sizeBytes = 85506 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-renderer/icon.rarView on unpkg

•path = dist-renderer/icon.rar kind = compressed_blob sizeBytes = 85506 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-renderer/icon.rarView on unpkg

•path = dist-renderer/icon.rar kind = nested_archive_needs_inspection sizeBytes = 85506 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist-renderer/icon.rarView on unpkg

dist-renderer/assets/index-C1ZICN-X.jsView file

•path = dist-renderer/assets/index-C1ZICN-X.js kind = oversized_source_file sizeBytes = 6516562 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist-renderer/assets/index-C1ZICN-X.jsView on unpkg

bin/hermit.mjsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.57 matchedPath = bin/hermit.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.57 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/hermit.mjsView on unpkg

bin/lib/daemon.mjsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.57 matchedPath = bin/lib/daemon.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.57 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/daemon.mjsView on unpkg

bin/lib/runtime.mjsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.57 matchedPath = bin/lib/runtime.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.57 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/runtime.mjsView on unpkg

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/kill-dev.jsView file

1#!/usr/bin/env node L2: import { spawnSync } from 'child_process'; L3:

High

Child Process

Package source references child process execution.

bin/kill-dev.jsView on unpkg · L1

Findings

1 Critical12 High9 Medium8 Low

CriticalAi Agent Control Hijackbin/postinstall.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/kill-dev.js

HighShellbin/kill-dev.js

HighSame File Env Network Executionbin/lib/auth.mjs

HighSandbox Evasion Gated Capabilitysrc/main/services/hermitBridge/CcConnectBinaryFetcher.ts

HighRuntime Package Installbin/lib/update.mjs

HighShips High Entropy Blobdist-renderer/icon.rar

HighKnown Malware Source Similaritybin/hermit.mjs

HighKnown Malware Source Similaritybin/lib/auth.mjs

HighKnown Malware Source Similaritybin/lib/daemon.mjs

Affected versions and remediation

This report applies to @yancyyu/agentcli@1.9.62.

The versions list below shows the verdict for each recorded version.

Avoid installing @yancyyu/agentcli@1.9.62. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-23 12:17:18.046Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

50 known versions

1.10.0latestMaliciousMalwareBlockPublishedJul 29, 2026, 2:40 AM 1.9.80MaliciousMalwareBlockPublishedJul 28, 2026, 4:54 AM 1.9.79MaliciousMalwareBlockPublishedJul 28, 2026, 2:19 AM 1.9.78MaliciousMalwareBlockPublishedJul 27, 2026, 8:25 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Behavioral surface

Related packages

Other credential exfiltration packages

Source & flagged code