Loading npm security reports…

@yancyyu/agentcli@1.9.31: Malicious npm security report (Block) | LPM Firewall

registry / @yancyyu/agentcli / 1.9.31

@yancyyu/agentcli@1.9.31

AgentCli: AI 工程协作平台，本地优先的用量采集与团队协作工具。

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The runtime decrypts credentials belonging to the separately installed lark-cli and uploads their application secret plus access and refresh tokens. The upload is hidden within the usage telemetry worker rather than a Lark-specific user command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

agentcli init, usage start, or its enabled launchd worker

Impact

Account takeover or unauthorized API access using exfiltrated long-lived credentials.

Mechanism

decrypt, refresh, and batch-upload third-party Lark credentials

Attack narrative

After the user starts the advertised usage service, the worker enumerates lark-cli profiles, decrypts credentials from its local store, refreshes them, and POSTs batches containing app secrets and access/refresh tokens to the configured AgentBus endpoint. The worker runs immediately and then every five minutes; the init UX describes the service as local JSONL usage collection, not credential export.

Rationale

Source establishes a concrete third-party credential-harvesting and exfiltration chain, activated by ordinary telemetry startup and insufficiently disclosed. This is malicious regardless of the AgentBus authentication gate.

Evidence

package.jsonbin/hermit.mjsbin/lib/servicesCommand.mjssrc/main/telemetry/worker.tssrc/main/telemetry/larkCredentials.tssrc/shared/constants/cloudConfig.mjs~/Library/Application Support/lark-cli/*.enc~/.lark-cli/config.json

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/kill-dev.jsView file

1#!/usr/bin/env node L2: import { spawnSync } from 'child_process'; L3:

High

Child Process

Package source references child process execution.

bin/kill-dev.jsView on unpkg · L1

8stdio: 'inherit', L9: shell: true, L10: });

High

Shell

Package source references shell execution.

bin/kill-dev.jsView on unpkg · L8

bin/lib/navigationCommand.mjsView file

137L138: const require = createRequire(import.meta.url); L139:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lib/navigationCommand.mjsView on unpkg · L137

bin/lib/teams.mjsView file

70if (!raw) return ''; L71: if (raw === '~') return os.homedir(); L72: if (raw.startsWith('~/')) return path.join(os.homedir(), raw.slice(2));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/lib/teams.mjsView on unpkg · L70

bin/lib/aikey.mjsView file

13// environment variables (user request, 2026-07): a marked block in L14: // ~/.zshrc / ~/.bashrc so new shells export it, `launchctl setenv` on macOS L15: // for GUI apps, and the HKCU user environment on Windows. This replaces the ... L32: import path from 'node:path'; L33: import { spawnSync } from 'node:child_process'; L34: import { mkdirSync, readFileSync, writeFileSync, existsSync, copyFileSync } from 'node:fs'; ... L137: try { L138: raw = JSON.parse(readFileSync(mockPath, 'utf-8')); L139: } catch { ... L149: if (!ctx) return null; L150: const res = await fetch(`${ctx.baseUrl}/api/v1/hermit/ai-key`, { L151: headers: { Authorization: `Bearer ${ctx.token}`, Accept: 'application/json' },

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/lib/aikey.mjsView on unpkg · L13

bin/lib/auth.mjsView file

380async function openExternalUrl(url) { L381: const mode = process.env.OPENHERMIT_AUTH_OPEN_BROWSER || process.env.OPENHERMIT_OAUTH_OPEN_BROWSER; L382: if (mode === '0') return { opened: false, skipped: true }; L383: if (mode === 'fetch') { L384: await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(30_000) }); L385: return { opened: true, mode: 'fetch' }; ... L390: // as a single argument, so query characters (& ? =) need no shell quoting. L391: // The previous powershell `Start-Process -FilePath $args[0]` form exited L392: // non-zero and the browser silently never opened on Windows.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/lib/auth.mjsView on unpkg · L380

bin/postinstall.mjsView file

1Install-time AI-agent control hijack evidence: L3: import { L4: copyFileSync, L5: cpSync, L6: existsSync, L7: mkdirSync, L8: readFileSync, ... L11: rmSync, L12: writeFileSync, L13: } from 'node:fs'; ... L46: const bundledWorkflowsDir = path.join(packageRoot, 'src/main/services/system-manager/builtin-workflows'); L47: const hermitWorkflowDir = path.join(hermitHome, '.claude', 'workflow'); L48: const builtinWorkflowMarker = ''; Payload evidence from src/renderer/features/CLAUDE.md: L1: # Renderer Features - Legacy Note L2:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall.mjsView on unpkg · L1

bin/lib/update.mjsView file

90try { L91: exec(`npm install -g ${BRAND.npmPackage}@latest --registry=https://registry.npmjs.org/`, { L92: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/lib/update.mjsView on unpkg · L90

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.26 matchedPath = bin/lib/update.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/update.mjsView on unpkg

dist-renderer/icon.rarView file

•path = dist-renderer/icon.rar kind = high_entropy_blob sizeBytes = 85506 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-renderer/icon.rarView on unpkg

•path = dist-renderer/icon.rar kind = compressed_blob sizeBytes = 85506 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-renderer/icon.rarView on unpkg

•path = dist-renderer/icon.rar kind = nested_archive_needs_inspection sizeBytes = 85506 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist-renderer/icon.rarView on unpkg

dist-renderer/assets/index-C5DsdTJc.jsView file

•path = dist-renderer/assets/index-C5DsdTJc.js kind = oversized_source_file sizeBytes = 6542638 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist-renderer/assets/index-C5DsdTJc.jsView on unpkg

bin/lib/daemon.mjsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.26 matchedPath = bin/lib/daemon.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/daemon.mjsView on unpkg

bin/lib/usageCommand.mjsView file

•matchType = token_shingles matchedPackage = @yancyyu/agentcli@1.9.26 matchedPath = bin/lib/usageCommand.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.26 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/usageCommand.mjsView on unpkg

bin/lib/feishuAssistant.mjsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.26 matchedPath = bin/lib/feishuAssistant.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/feishuAssistant.mjsView on unpkg

bin/lib/larkSecrets.mjsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.26 matchedPath = bin/lib/larkSecrets.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/larkSecrets.mjsView on unpkg