Loading npm security reports…

@yancyyu/agentcli@1.9.26: Malicious npm security report (Block) | LPM Firewall

registry / @yancyyu/agentcli / 1.9.26

@yancyyu/agentcli@1.9.26

AgentCli: AI 工程协作平台，本地优先的用量采集与团队协作工具。

AI Security Review

scanned 2h ago · by lpm-firewall-ai

A successful AgentCli Lark digital-worker authorization silently triggers collection, refresh, and upload of full Lark CLI credentials. The upload includes reusable application secrets and access/refresh tokens.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User completes the AgentCli Lark digital-worker authorization flow or explicitly runs `lark:report-once`.

Impact

Compromise of all eligible local Lark CLI authorizations and associated application secrets.

Mechanism

Silent Lark credential harvesting and authenticated batch exfiltration.

Attack narrative

After the user completes Lark authorization for a digital worker, AgentCli starts credential synchronization in the background. The reporting path enumerates eligible lark-cli profiles, refreshes them, then sends app secrets plus access and refresh tokens to the AgentBus endpoint. The reporting is detached and not presented as a consented export of reusable credentials.

Rationale

Source confirms a concrete credential-exfiltration chain, not merely scanner heuristics. The install-time workflow setup is secondary and does not mitigate the silent credential upload.

Evidence

package.jsonbin/postinstall.mjsbin/lib/navigationCommand.mjsbin/lib/larkSecrets.mjsscripts/report-lark-credentials-once.mjssrc/main/telemetry/larkCredentials.ts~/Library/Application Support/lark-cli/*.enc~/.hermit/.claude/workflow/*

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/kill-dev.jsView file

1#!/usr/bin/env node L2: import { spawnSync } from 'child_process'; L3:

High

Child Process

Package source references child process execution.

bin/kill-dev.jsView on unpkg · L1

8stdio: 'inherit', L9: shell: true, L10: });

High

Shell

Package source references shell execution.

bin/kill-dev.jsView on unpkg · L8

bin/lib/navigationCommand.mjsView file

136L137: const require = createRequire(import.meta.url); L138:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lib/navigationCommand.mjsView on unpkg · L136

bin/lib/teams.mjsView file

70if (!raw) return ''; L71: if (raw === '~') return os.homedir(); L72: if (raw.startsWith('~/')) return path.join(os.homedir(), raw.slice(2));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/lib/teams.mjsView on unpkg · L70

bin/lib/aikey.mjsView file

13// environment variables (user request, 2026-07): a marked block in L14: // ~/.zshrc / ~/.bashrc so new shells export it, `launchctl setenv` on macOS L15: // for GUI apps, and the HKCU user environment on Windows. This replaces the ... L32: import path from 'node:path'; L33: import { spawnSync } from 'node:child_process'; L34: import { mkdirSync, readFileSync, writeFileSync, existsSync, copyFileSync } from 'node:fs'; ... L137: try { L138: raw = JSON.parse(readFileSync(mockPath, 'utf-8')); L139: } catch { ... L149: if (!ctx) return null; L150: const res = await fetch(`${ctx.baseUrl}/api/v1/hermit/ai-key`, { L151: headers: { Authorization: `Bearer ${ctx.token}`, Accept: 'application/json' },

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/lib/aikey.mjsView on unpkg · L13

bin/lib/auth.mjsView file

378async function openExternalUrl(url) { L379: const mode = process.env.OPENHERMIT_AUTH_OPEN_BROWSER || process.env.OPENHERMIT_OAUTH_OPEN_BROWSER; L380: if (mode === '0') return { opened: false, skipped: true }; L381: if (mode === 'fetch') { L382: await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(30_000) }); L383: return { opened: true, mode: 'fetch' }; ... L388: // as a single argument, so query characters (& ? =) need no shell quoting. L389: // The previous powershell `Start-Process -FilePath $args[0]` form exited L390: // non-zero and the browser silently never opened on Windows.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/lib/auth.mjsView on unpkg · L378

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.25 matchedPath = bin/lib/auth.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/auth.mjsView on unpkg

bin/postinstall.mjsView file

1Install-time AI-agent control hijack evidence: L3: import { L4: copyFileSync, L5: cpSync, L6: existsSync, L7: mkdirSync, L8: readFileSync, ... L11: rmSync, L12: writeFileSync, L13: } from 'node:fs'; ... L46: const bundledWorkflowsDir = path.join(packageRoot, 'src/main/services/system-manager/builtin-workflows'); L47: const hermitWorkflowDir = path.join(hermitHome, '.claude', 'workflow'); L48: const builtinWorkflowMarker = ''; Payload evidence from src/renderer/features/CLAUDE.md: L1: # Renderer Features - Legacy Note L2:

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

bin/postinstall.mjsView on unpkg · L1

bin/lib/update.mjsView file

90try { L91: exec(`npm install -g ${BRAND.npmPackage}@latest --registry=https://registry.npmjs.org/`, { L92: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/lib/update.mjsView on unpkg · L90

dist-renderer/icon.rarView file

•path = dist-renderer/icon.rar kind = high_entropy_blob sizeBytes = 85506 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-renderer/icon.rarView on unpkg

•path = dist-renderer/icon.rar kind = compressed_blob sizeBytes = 85506 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-renderer/icon.rarView on unpkg

•path = dist-renderer/icon.rar kind = nested_archive_needs_inspection sizeBytes = 85506 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist-renderer/icon.rarView on unpkg

dist-renderer/assets/index-C1Gc2uYo.jsView file

•path = dist-renderer/assets/index-C1Gc2uYo.js kind = oversized_source_file sizeBytes = 6541912 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-renderer/assets/index-C1Gc2uYo.jsView on unpkg

bin/hermit.mjsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.25 matchedPath = bin/hermit.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/hermit.mjsView on unpkg

bin/lib/daemon.mjsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.25 matchedPath = bin/lib/daemon.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/daemon.mjsView on unpkg

bin/lib/usageCommand.mjsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.25 matchedPath = bin/lib/usageCommand.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/usageCommand.mjsView on unpkg

bin/lib/feishuAssistant.mjsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.25 matchedPath = bin/lib/feishuAssistant.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/feishuAssistant.mjsView on unpkg