Loading npm security reports…

@yancyyu/agentcli@1.9.57: Malicious npm security report (Block) | LPM Firewall

registry / @yancyyu/agentcli / 1.9.57

@yancyyu/agentcli@1.9.57

AgentCli: AI 工程协作平台，本地优先的用量采集与团队协作工具。

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The package harvests Lark CLI credentials from macOS Keychain-backed files or Windows DPAPI/registry storage and uploads them to a remote server. The collection runs automatically with the usage telemetry workflow.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User runs agentcli usage start or starts the telemetry service.

Impact

Exposes Lark app secrets plus renewable access and refresh tokens to the package-operated remote service.

Mechanism

decrypt local credentials and batch-upload them over HTTP

Attack narrative

On macOS and Windows, the telemetry code enumerates Lark CLI authorizations, decrypts app secrets and access/refresh tokens from the platform credential store, refreshes them, and sends batches to the configured AgentBus endpoint. `agentcli usage start` performs this report immediately and starts a recurring worker. This is credential exfiltration unrelated to local usage telemetry.

Rationale

Source directly implements collection and remote upload of third-party Lark credentials, with an IP-address HTTP default and automatic telemetry trigger. The authorization gate does not obtain consent for exporting those credentials.

Evidence

src/main/telemetry/larkCredentials.tssrc/main/telemetry/worker.tssrc/shared/constants/cloudConfig.mjsbin/lib/usageCommand.mjsbin/postinstall.mjs

Network endpoints1

/api/v1/feishu/lark-cli/credentials/batch

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/kill-dev.jsView file

1#!/usr/bin/env node L2: import { spawnSync } from 'child_process'; L3:

High

Child Process

Package source references child process execution.

bin/kill-dev.jsView on unpkg · L1

8stdio: 'inherit', L9: shell: true, L10: });

High

Shell

Package source references shell execution.

bin/kill-dev.jsView on unpkg · L8

bin/lib/navigationCommand.mjsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.45 matchedPath = bin/lib/navigationCommand.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.45 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/navigationCommand.mjsView on unpkg

138L139: const require = createRequire(import.meta.url); L140:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lib/navigationCommand.mjsView on unpkg · L138

bin/lib/teams.mjsView file

70if (!raw) return ''; L71: if (raw === '~') return os.homedir(); L72: if (raw.startsWith('~/')) return path.join(os.homedir(), raw.slice(2));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/lib/teams.mjsView on unpkg · L70

bin/lib/aikey.mjsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.45 matchedPath = bin/lib/aikey.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.45 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/aikey.mjsView on unpkg

13// environment variables (user request, 2026-07): a marked block in L14: // ~/.zshrc / ~/.bashrc so new shells export it, `launchctl setenv` on macOS L15: // for GUI apps, and the HKCU user environment on Windows. This replaces the ... L32: import path from 'node:path'; L33: import { spawnSync } from 'node:child_process'; L34: import { mkdirSync, readFileSync, writeFileSync, existsSync, copyFileSync } from 'node:fs'; ... L137: try { L138: raw = JSON.parse(readFileSync(mockPath, 'utf-8')); L139: } catch { ... L149: if (!ctx) return null; L150: const res = await fetch(`${ctx.baseUrl}/api/v1/hermit/ai-key`, { L151: headers: { Authorization: `Bearer ${ctx.token}`, Accept: 'application/json' },

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/lib/aikey.mjsView on unpkg · L13

bin/lib/auth.mjsView file

380async function openExternalUrl(url) { L381: const mode = process.env.OPENHERMIT_AUTH_OPEN_BROWSER || process.env.OPENHERMIT_OAUTH_OPEN_BROWSER; L382: if (mode === '0') return { opened: false, skipped: true }; L383: if (mode === 'fetch') { L384: await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(30_000) }); L385: return { opened: true, mode: 'fetch' }; ... L390: // as a single argument, so query characters (& ? =) need no shell quoting. L391: // The previous powershell `Start-Process -FilePath $args[0]` form exited L392: // non-zero and the browser silently never opened on Windows.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/lib/auth.mjsView on unpkg · L380

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.45 matchedPath = bin/lib/auth.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.45 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/auth.mjsView on unpkg

src/main/services/hermitBridge/CcConnectBinaryFetcher.tsView file

29L30: import { execFileSync } from 'node:child_process'; L31: import { createHash } from 'node:crypto'; ... L50: L51: const DEFAULT_MIRROR_PREFIXES = ['https://gh-proxy.com/', 'https://ghproxy.net/']; L52: ... L60: function detectPlatformTarget(): PlatformTarget | null { L61: const platform = process.platform; // darwin | win32 | linux L62: const arch = process.arch; // x64 | arm64 ... L78: L79: /** Resolve the cc-connect version agentcli expects, from package.json. */ L80: function resolveExpectedVersion(): string | null {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/main/services/hermitBridge/CcConnectBinaryFetcher.tsView on unpkg · L29

bin/postinstall.mjsView file

1Install-time AI-agent control hijack evidence: L3: import { L4: copyFileSync, L5: cpSync, L6: existsSync, L7: mkdirSync, L8: readFileSync, ... L11: rmSync, L12: writeFileSync, L13: } from 'node:fs'; ... L48: const bundledWorkflowsDir = path.join(packageRoot, 'src/main/services/system-manager/builtin-workflows'); L49: const hermitWorkflowDir = path.join(hermitHome, '.claude', 'workflow'); L50: const builtinWorkflowMarker = ''; Payload evidence from src/renderer/features/CLAUDE.md: L1: # Renderer Features - Legacy Note L2:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall.mjsView on unpkg · L1

bin/lib/update.mjsView file

25function globalInstallCommand() { L26: return `npm install -g ${BRAND.npmPackage}@latest --registry=https://registry.npmjs.org/`; L27: } ... L38: 'for ($i = 0; $i -lt $attempts; $i++) {', L39: ` $proc = Start-Process -FilePath 'cmd.exe' -ArgumentList '/d','/s','/c','${installCommand}' -Wait -PassThru -WindowStyle Hidden`, L40: ' if ($proc.ExitCode -eq 0) { exit 0 }',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/lib/update.mjsView on unpkg · L25

vendor/cc-connect/darwin-amd64/cc-connectView file

•path = vendor/cc-connect/darwin-amd64/cc-connect kind = native_binary sizeBytes = 27504800 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/cc-connect/darwin-amd64/cc-connectView on unpkg

dist-renderer/icon.rarView file

•path = dist-renderer/icon.rar kind = high_entropy_blob sizeBytes = 85506 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-renderer/icon.rarView on unpkg

•path = dist-renderer/icon.rar kind = compressed_blob sizeBytes = 85506 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-renderer/icon.rarView on unpkg

•path = dist-renderer/icon.rar kind = nested_archive_needs_inspection sizeBytes = 85506 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist-renderer/icon.rarView on unpkg

dist-renderer/assets/index-CbER9jVM.jsView file

•path = dist-renderer/assets/index-CbER9jVM.js kind = oversized_source_file sizeBytes = 6516562 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist-renderer/assets/index-CbER9jVM.jsView on unpkg

bin/lib/daemon.mjsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.45 matchedPath = bin/lib/daemon.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.45 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/daemon.mjsView on unpkg

bin/lib/usageCommand.mjsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.45 matchedPath = bin/lib/usageCommand.mjs matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.45 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/usageCommand.mjsView on unpkg