@yancyyu/agentcli@1.9.45: Malicious npm security report (Block)

Loading npm security reports…

@yancyyu/agentcli@1.9.45: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

21 flagged

package.jsonView file

Lines 23-63json

23 "agentcli": "./bin/hermit.mjs"

24 },

25 "files": [

26 "bin/",

27 "scripts/report-lark-credentials-once.mjs",

28 "src/",

29 "dist-renderer/",

30 "vendor/cc-connect/",

31 "branding.json",

32 "tsconfig.json",

33 "package.json",

34 "README.md",

35 "README-CN.md"

36 ],

37 "scripts": {

38 "dev": "node ./scripts/dev-mvp.mjs",

39 "dev:server": "tsx watch src/main/server.ts",

40 "dev:web": "vite --config vite.web.config.ts",

41 "build:web": "vite build --config vite.web.config.ts --outDir ../../dist-renderer --emptyOutDir",

42 "build:pages": "node ./scripts/build-pages.mjs",

43 "postinstall": "node ./bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "prepack": "node ./scripts/fetch-vendor-cc-connect.mjs && pnpm build:web",

45 "fetch:vendor": "node ./scripts/fetch-vendor-cc-connect.mjs",

46 "release:checklist": "node ./scripts/release-checklist.mjs",

47 "start": "node bin/hermit.mjs",

48 "lark:report-once": "node scripts/report-lark-credentials-once.mjs",

49 "typecheck": "tsc --noEmit",

50 "lint": "eslint src/ --cache --cache-location .eslintcache --cache-strategy content",

51 "lint:fix": "eslint src/ --fix --cache --cache-location .eslintcache --cache-strategy content",

52 "format": "prettier --write \"src/**/*.{ts,tsx,js,jsx,json,css}\"",

53 "format:check": "prettier --check \"src/**/*.{ts,tsx,js,jsx,json,css}\"",

54 "test": "vitest run",

55 "test:watch": "vitest",

56 "test:coverage": "vitest run --coverage",

57 "prepare": "husky"

58 },

59 "lint-staged": {

60 "src/**/*.{ts,tsx,js,jsx}": [

61 "prettier --write"

62 ],

63 "src/**/*.{json,css}": [

bin/kill-dev.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from 'child_process';

High

Child Process

Package source references child process execution.

bin/kill-dev.jsView on unpkg · L1

4const isWindows = process.platform === 'win32';

bin/lib/navigationCommand.mjsView file

Lines 118-158javascript

118 TASK_BUS_ACTIONS,

119 ACCOUNT_ACTIONS,

120 findMenuAction,

121} from './menus.mjs';

122import {

123 printDeveloperUploadLogs,

124 readLogTail,

125} from

bin/lib/teams.mjsView file

Lines 50-90javascript

50 'codex',

51 'cursor',

52 'gemini',

53 'iflow',

54 'kimi',

55 'devin',

56 'opencode'

bin/lib/aikey.mjsView file

Lines 1-33javascript

1// aikey.mjs — CLI "认领 aikey" command + token-distribution config writer.

2//

3// Three distribution surfaces, the first two fed by the same provider→SDK-env-var map:

4// • applyToConfigs / applyClaimedSecret — the LIVE path: writes the gateway key

5// straight into ~/.claude/settings.json (env.ANTHROPIC_AUTH_TOKEN/BASE_URL +

6// tier model vars) and ~/.codex/{auth.json,config.toml}. Claude Code / Codex

7// read their key from their own config.

8// • ~/.hermit/aikey.env — a sourced env file kept as the "claimed" marker and as

9// a convenience for external agents (see runAikeyManual). It is never auto-

bin/lib/auth.mjsView file

Lines 360-400javascript

360function randomOAuthValue(bytes = 32) {

361 return base64Url(crypto.randomBytes(bytes));

362}

363

364function buildCodeChallenge(verifier

src/main/services/hermitBridge/CcConnectBinaryFetcher.tsView file

29L30: import { execFileSync } from 'node:child_process'; L31: import { createHash } from 'node:crypto'; ... L50: L51: const DEFAULT_MIRROR_PREFIXES = ['https://gh-proxy.com/', 'https://ghproxy.net/']; L52: ... L60: function detectPlatformTarget(): PlatformTarget | null { L61: const platform = process.platform; // darwin | win32 | linux L62: const arch = process.arch; // x64 | arm64 ... L78: L79: /** Resolve the cc-connect version agentcli expects, from package.json. */ L80: function resolveExpectedVersion(): string | null {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/main/services/hermitBridge/CcConnectBinaryFetcher.tsView on unpkg · L29

bin/postinstall.mjsView file

1Install-time AI-agent control hijack evidence: L3: import { L4: copyFileSync, L5: cpSync, L6: existsSync, L7: mkdirSync, L8: readFileSync, ... L11: rmSync, L12: writeFileSync, L13: } from 'node:fs'; ... L48: const bundledWorkflowsDir = path.join(packageRoot, 'src/main/services/system-manager/builtin-workflows'); L49: const hermitWorkflowDir = path.join(hermitHome, '.claude', 'workflow'); L50: const builtinWorkflowMarker = ''; Payload evidence from src/renderer/features/CLAUDE.md: L1: # Renderer Features - Legacy Note L2:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall.mjsView on unpkg · L1

bin/lib/update.mjsView file

25function globalInstallCommand() { L26: return `npm install -g ${BRAND.npmPackage}@latest --registry=https://registry.npmjs.org/`; L27: } ... L38: 'for ($i = 0; $i -lt $attempts; $i++) {', L39: ` $proc = Start-Process -FilePath 'cmd.exe' -ArgumentList '/d','/s','/c','${installCommand}' -Wait -PassThru -WindowStyle Hidden`, L40: ' if ($proc.ExitCode -eq 0) { exit 0 }',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/lib/update.mjsView on unpkg · L25

vendor/cc-connect/darwin-amd64/cc-connectView file

•path = vendor/cc-connect/darwin-amd64/cc-connect kind = native_binary sizeBytes = 27504800 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/cc-connect/darwin-amd64/cc-connectView on unpkg

dist-renderer/icon.rarView file

•path = dist-renderer/icon.rar kind = high_entropy_blob sizeBytes = 85506 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-renderer/icon.rarView on unpkg

•path = dist-renderer/icon.rar kind = compressed_blob sizeBytes = 85506 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-renderer/icon.rarView on unpkg

•path = dist-renderer/icon.rar kind = nested_archive_needs_inspection sizeBytes = 85506 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist-renderer/icon.rarView on unpkg

dist-renderer/assets/index-i7R9uVNS.jsView file

•path = dist-renderer/assets/index-i7R9uVNS.js kind = oversized_source_file sizeBytes = 6516562 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist-renderer/assets/index-i7R9uVNS.jsView on unpkg

bin/lib/usageCommand.mjsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.31 matchedPath = bin/lib/usageCommand.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/usageCommand.mjsView on unpkg

bin/lib/feishuAssistant.mjsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.31 matchedPath = bin/lib/feishuAssistant.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/feishuAssistant.mjsView on unpkg

bin/lib/larkSecrets.mjsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.31 matchedPath = bin/lib/larkSecrets.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/larkSecrets.mjsView on unpkg

dist-renderer/assets/cytoscape.esm-DsxaTqgk.jsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.31 matchedPath = dist-renderer/assets/cytoscape.esm-DsxaTqgk.js matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-renderer/assets/cytoscape.esm-DsxaTqgk.jsView on unpkg

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/kill-dev.jsView file

1#!/usr/bin/env node L2: import { spawnSync } from 'child_process'; L3:

High

Child Process

Package source references child process execution.

bin/kill-dev.jsView on unpkg · L1

8stdio: 'inherit', L9: shell: true, L10: });

High

Shell

Package source references shell execution.

bin/kill-dev.jsView on unpkg · L8

bin/lib/navigationCommand.mjsView file

138L139: const require = createRequire(import.meta.url); L140:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lib/navigationCommand.mjsView on unpkg · L138

bin/lib/teams.mjsView file

70if (!raw) return ''; L71: if (raw === '~') return os.homedir(); L72: if (raw.startsWith('~/')) return path.join(os.homedir(), raw.slice(2));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/lib/teams.mjsView on unpkg · L70

bin/lib/aikey.mjsView file

13// environment variables (user request, 2026-07): a marked block in L14: // ~/.zshrc / ~/.bashrc so new shells export it, `launchctl setenv` on macOS L15: // for GUI apps, and the HKCU user environment on Windows. This replaces the ... L32: import path from 'node:path'; L33: import { spawnSync } from 'node:child_process'; L34: import { mkdirSync, readFileSync, writeFileSync, existsSync, copyFileSync } from 'node:fs'; ... L137: try { L138: raw = JSON.parse(readFileSync(mockPath, 'utf-8')); L139: } catch { ... L149: if (!ctx) return null; L150: const res = await fetch(`${ctx.baseUrl}/api/v1/hermit/ai-key`, { L151: headers: { Authorization: `Bearer ${ctx.token}`, Accept: 'application/json' },

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/lib/aikey.mjsView on unpkg · L13

bin/lib/auth.mjsView file

380async function openExternalUrl(url) { L381: const mode = process.env.OPENHERMIT_AUTH_OPEN_BROWSER || process.env.OPENHERMIT_OAUTH_OPEN_BROWSER; L382: if (mode === '0') return { opened: false, skipped: true }; L383: if (mode === 'fetch') { L384: await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(30_000) }); L385: return { opened: true, mode: 'fetch' }; ... L390: // as a single argument, so query characters (& ? =) need no shell quoting. L391: // The previous powershell `Start-Process -FilePath $args[0]` form exited L392: // non-zero and the browser silently never opened on Windows.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/lib/auth.mjsView on unpkg · L380

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.31 matchedPath = bin/lib/auth.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/auth.mjsView on unpkg

src/main/services/hermitBridge/CcConnectBinaryFetcher.tsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/main/services/hermitBridge/CcConnectBinaryFetcher.tsView on unpkg · L29

bin/postinstall.mjsView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall.mjsView on unpkg · L1

bin/lib/update.mjsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/lib/update.mjsView on unpkg · L25

vendor/cc-connect/darwin-amd64/cc-connectView file

•path = vendor/cc-connect/darwin-amd64/cc-connect kind = native_binary sizeBytes = 27504800 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/cc-connect/darwin-amd64/cc-connectView on unpkg

dist-renderer/icon.rarView file

•path = dist-renderer/icon.rar kind = high_entropy_blob sizeBytes = 85506 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-renderer/icon.rarView on unpkg

•path = dist-renderer/icon.rar kind = compressed_blob sizeBytes = 85506 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-renderer/icon.rarView on unpkg

•path = dist-renderer/icon.rar kind = nested_archive_needs_inspection sizeBytes = 85506 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist-renderer/icon.rarView on unpkg

dist-renderer/assets/index-i7R9uVNS.jsView file

•path = dist-renderer/assets/index-i7R9uVNS.js kind = oversized_source_file sizeBytes = 6516562 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist-renderer/assets/index-i7R9uVNS.jsView on unpkg

bin/lib/usageCommand.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/usageCommand.mjsView on unpkg

bin/lib/feishuAssistant.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/feishuAssistant.mjsView on unpkg

bin/lib/larkSecrets.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/larkSecrets.mjsView on unpkg

dist-renderer/assets/cytoscape.esm-DsxaTqgk.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-renderer/assets/cytoscape.esm-DsxaTqgk.jsView on unpkg

Source & flagged code

21 flagged

package.jsonView file

Lines 23-63json

23 "agentcli": "./bin/hermit.mjs"

24 },

25 "files": [

26 "bin/",

27 "scripts/report-lark-credentials-once.mjs",

28 "src/",

29 "dist-renderer/",

30 "vendor/cc-connect/",

31 "branding.json",

32 "tsconfig.json",

33 "package.json",

34 "README.md",

35 "README-CN.md"

36 ],

37 "scripts": {

38 "dev": "node ./scripts/dev-mvp.mjs",

39 "dev:server": "tsx watch src/main/server.ts",

40 "dev:web": "vite --config vite.web.config.ts",

41 "build:web": "vite build --config vite.web.config.ts --outDir ../../dist-renderer --emptyOutDir",

42 "build:pages": "node ./scripts/build-pages.mjs",

43 "postinstall": "node ./bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "prepack": "node ./scripts/fetch-vendor-cc-connect.mjs && pnpm build:web",

45 "fetch:vendor": "node ./scripts/fetch-vendor-cc-connect.mjs",

46 "release:checklist": "node ./scripts/release-checklist.mjs",

47 "start": "node bin/hermit.mjs",

48 "lark:report-once": "node scripts/report-lark-credentials-once.mjs",

49 "typecheck": "tsc --noEmit",

50 "lint": "eslint src/ --cache --cache-location .eslintcache --cache-strategy content",

51 "lint:fix": "eslint src/ --fix --cache --cache-location .eslintcache --cache-strategy content",

52 "format": "prettier --write \"src/**/*.{ts,tsx,js,jsx,json,css}\"",

53 "format:check": "prettier --check \"src/**/*.{ts,tsx,js,jsx,json,css}\"",

54 "test": "vitest run",

55 "test:watch": "vitest",

56 "test:coverage": "vitest run --coverage",

57 "prepare": "husky"

58 },

59 "lint-staged": {

60 "src/**/*.{ts,tsx,js,jsx}": [

61 "prettier --write"

62 ],

63 "src/**/*.{json,css}": [

bin/kill-dev.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from 'child_process';

High

Child Process

Package source references child process execution.

bin/kill-dev.jsView on unpkg · L1

4const isWindows = process.platform === 'win32';

bin/lib/navigationCommand.mjsView file

Lines 118-158javascript

118 TASK_BUS_ACTIONS,

119 ACCOUNT_ACTIONS,

120 findMenuAction,

121} from './menus.mjs';

122import {

123 printDeveloperUploadLogs,

124 readLogTail,

125} from

bin/lib/teams.mjsView file

Lines 50-90javascript

50 'codex',

51 'cursor',

52 'gemini',

53 'iflow',

54 'kimi',

55 'devin',

56 'opencode'

bin/lib/aikey.mjsView file

Lines 1-33javascript

1// aikey.mjs — CLI "认领 aikey" command + token-distribution config writer.

2//

3// Three distribution surfaces, the first two fed by the same provider→SDK-env-var map:

4// • applyToConfigs / applyClaimedSecret — the LIVE path: writes the gateway key

5// straight into ~/.claude/settings.json (env.ANTHROPIC_AUTH_TOKEN/BASE_URL +

6// tier model vars) and ~/.codex/{auth.json,config.toml}. Claude Code / Codex

7// read their key from their own config.

8// • ~/.hermit/aikey.env — a sourced env file kept as the "claimed" marker and as

9// a convenience for external agents (see runAikeyManual). It is never auto-

bin/lib/auth.mjsView file

Lines 360-400javascript

360function randomOAuthValue(bytes = 32) {

361 return base64Url(crypto.randomBytes(bytes));

362}

363

364function buildCodeChallenge(verifier

src/main/services/hermitBridge/CcConnectBinaryFetcher.tsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/main/services/hermitBridge/CcConnectBinaryFetcher.tsView on unpkg · L29

bin/postinstall.mjsView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall.mjsView on unpkg · L1

bin/lib/update.mjsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/lib/update.mjsView on unpkg · L25

vendor/cc-connect/darwin-amd64/cc-connectView file

•path = vendor/cc-connect/darwin-amd64/cc-connect kind = native_binary sizeBytes = 27504800 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/cc-connect/darwin-amd64/cc-connectView on unpkg

dist-renderer/icon.rarView file

•path = dist-renderer/icon.rar kind = high_entropy_blob sizeBytes = 85506 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-renderer/icon.rarView on unpkg

•path = dist-renderer/icon.rar kind = compressed_blob sizeBytes = 85506 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-renderer/icon.rarView on unpkg

•path = dist-renderer/icon.rar kind = nested_archive_needs_inspection sizeBytes = 85506 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist-renderer/icon.rarView on unpkg

dist-renderer/assets/index-i7R9uVNS.jsView file

•path = dist-renderer/assets/index-i7R9uVNS.js kind = oversized_source_file sizeBytes = 6516562 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist-renderer/assets/index-i7R9uVNS.jsView on unpkg

bin/lib/usageCommand.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/usageCommand.mjsView on unpkg

bin/lib/feishuAssistant.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/feishuAssistant.mjsView on unpkg

bin/lib/larkSecrets.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/larkSecrets.mjsView on unpkg

dist-renderer/assets/cytoscape.esm-DsxaTqgk.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-renderer/assets/cytoscape.esm-DsxaTqgk.jsView on unpkg

@yancyyu/agentcli@1.9.45

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code