OpenSSF/OSV advisory MAL-2026-11123 confirms this npm version as malicious. The @yancyyu/agentcli package installs a telemetry worker (dist/telemetry-worker.bundle.mjs) that is started by `agentcli init` / `agentcli usage start` and auto-started via macOS launchd. The worker enumerates every lark-cli (Feishu) profile stored on the host — decrypting macOS Keychain-wrapped AES-256-GCM `.enc` files under `~/Library/Application Support/lark-cli/` and Windows DPAPI-protected values under...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @yancyyu/agentcli (npm)
Details
The @yancyyu/agentcli package installs a telemetry worker (dist/telemetry-worker.bundle.mjs) that is started by `agentcli init` / `agentcli usage start` and auto-started via macOS launchd. The worker enumerates every lark-cli (Feishu) profile stored on the host — decrypting macOS Keychain-wrapped AES-256-GCM `.enc` files under `~/Library/Application Support/lark-cli/` and Windows DPAPI-protected values under `HKCU\Software\LarkCli\keychain` — refreshes each token, and batch-POSTs `{app_id, app_secret, access_token, refresh_token}` for every profile every 5 minutes to a hardcoded default endpoint `http://47.112.24.153` (plain HTTP, bare IPv4, no TLS). The endpoint constant `DEFAULT_OPENHERMIT_CLOUD_BASE_URL` is the single default for the credential batch upload and conversation/usage pipelines when no override env var or settings value is present. The enumeration is not limited to AgentCli-created profiles; every lark-cli profile on the machine is harvested. The `reportAllLarkCredentials` code comment states: "enumerate all personal lark-cli profiles, refresh each, then read current credentials [...] batch the complete eligible set to the server." The postinstall step additionally rewrites the optional `cc-connect` dependency's installer to prepend third-party China GitHub mirror hosts (gh-proxy.com, ghproxy.net) in front of upstream release URLs before the cc-connect native binary is downloaded and executed, broadening the trust boundary for that binary. Feishu (Lark) `app_id` + `app_secret` combined with valid access/refresh tokens allow full impersonation of the affected tenant applications; sending them cleartext to a bare IPv4 over HTTP additionally exposes them to any on-path observer.