{"id":"MAL-2026-11123","summary":"Malicious code in @yancyyu/agentcli (npm)","details":"The npm package `@yancyyu/agentcli` ships a Feishu/Lark credential stealer. An auto-started telemetry worker (`src/main/telemetry/worker.ts`, started via `agentcli init`/`agentcli usage start` and macOS launchd) calls `safeScanLarkCredentials()` in its periodic run loop; the scan reads and decrypts local Lark credentials (macOS Keychain AES-256-GCM `.enc` under `~/Library/Application Support/lark-cli/`, Windows DPAPI under `HKCU\\Software\\LarkCli\\keychain`), refreshes tokens and POSTs {app_id, app_secret, access_token, refresh_token} to the operator backend (endpoint `/api/v1/report/lark-credentials`, later renamed `/api/v1/feishu/lark-cli/credentials`; default cloud hosts include `agentbus.skg.com`, `159.75.231.98:8088`, `47.112.24.153`).\n\nThese versions are not part of the existing OSV record MAL-2026-11123 (Amazon Inspector), which covers 1.9.25-1.9.80. The true malicious boundary is 1.9.9 (2026-07-12) via the import-\u003ecall reachability chain (`telemetry/worker.ts` -\u003e `larkCredentials`), 16 versions earlier than the previously-catalogued 1.9.25; the reachable credential theft is present continuously across 1.9.9-1.9.24 (each verified) and 1.10.0. Versions 1.8.8-1.9.8 exfiltrate local Claude/Codex conversations to the same backend but do not yet steal Lark credentials (out of scope for this malware record).\n\nThis report extends the confirmed-malicious set with 17 additional versions and an earlier boundary, scoped to the versions not yet listed in MAL-2026-11123 to avoid duplication. Determined by static code and dataflow review of the published npm tarballs.\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7f6774653f487db8fbb9b40f1c1aba2bf959edffae409445162b0d245a3bedf1)\nThe @yancyyu/agentcli package installs a telemetry worker (dist/telemetry-worker.bundle.mjs) that is started by `agentcli init` / `agentcli usage start` and auto-started via macOS launchd. The worker enumerates every lark-cli (Feishu) profile stored on the host — decrypting macOS Keychain-wrapped AES-256-GCM `.enc` files under `~/Library/Application Support/lark-cli/` and Windows DPAPI-protected values under `HKCU\\Software\\LarkCli\\keychain` — refreshes each token, and batch-POSTs `{app_id, app_secret, access_token, refresh_token}` for every profile every 5 minutes to a hardcoded default endpoint `http://47.112.24.153` (plain HTTP, bare IPv4, no TLS). The endpoint constant `DEFAULT_OPENHERMIT_CLOUD_BASE_URL` is the single default for the credential batch upload and conversation/usage pipelines when no override env var or settings value is present. The enumeration is not limited to AgentCli-created profiles; every lark-cli profile on the machine is harvested. The `reportAllLarkCredentials` code comment states: \"enumerate all personal lark-cli profiles, refresh each, then read current credentials [...] batch the complete eligible set to the server.\" The postinstall step additionally rewrites the optional `cc-connect` dependency's installer to prepend third-party China GitHub mirror hosts (gh-proxy.com, ghproxy.net) in front of upstream release URLs before the cc-connect native binary is downloaded and executed, broadening the trust boundary for that binary. Feishu (Lark) `app_id` + `app_secret` combined with valid access/refresh tokens allow full impersonation of the affected tenant applications; sending them cleartext to a bare IPv4 over HTTP additionally exposes them to any on-path observer.\n","modified":"2026-09-11T04:00:06.611592087Z","published":"2026-07-28T13:30:51Z","database_specific":{"malicious-packages-origins":[{"sha256":"10b67ca39014513878a16bd2459cd4f1e6ebf24934aa5784df51b9acc766f264","source":"amazon-inspector","versions":["1.9.32"],"id":"IN-MAL-2026-010879","import_time":"2026-07-28T14:19:57.174630207Z","modified_time":"2026-07-28T13:30:51Z"},{"modified_time":"2026-08-05T12:51:30Z","sha256":"7a6db15f3c61b8f2b394478af94c4b9f58cdce9f5007012b8e0e5b883f8ccb81","source":"amazon-inspector","versions":["1.9.42"],"id":"IN-MAL-2026-014789","import_time":"2026-08-05T13:08:46.640961459Z"},{"source":"amazon-inspector","versions":["1.9.35"],"id":"IN-MAL-2026-014814","import_time":"2026-08-05T13:08:48.527862019Z","modified_time":"2026-08-05T12:56:07Z","sha256":"88391b25e025074f89b9807478519246f9b12a7ad1929a0a04c4ba12eddf9a07"},{"versions":["1.9.27"],"id":"IN-MAL-2026-014800","import_time":"2026-08-05T13:08:47.405694498Z","modified_time":"2026-08-05T12:53:12Z","sha256":"f9b6bcbf02d925d1138d0cedb9d31e8c78792d419bb0f1f165ac721b2a358803","source":"amazon-inspector"},{"versions":["1.9.52"],"id":"IN-MAL-2026-017173","import_time":"2026-08-08T00:53:08.565570322Z","modified_time":"2026-08-08T00:48:36Z","sha256":"56ca7986e94bf6014ed0c7aa7402d3c6db6e8f6de75d630f261465203cfc3cb7","source":"amazon-inspector"},{"source":"amazon-inspector","versions":["1.9.43"],"id":"IN-MAL-2026-017175","import_time":"2026-08-08T00:53:08.711795544Z","modified_time":"2026-08-08T00:48:59Z","sha256":"56d4294e5480488e46551a40136052a1dd16c42720ea2509835db2d5fafc03a8"},{"versions":["1.9.61"],"id":"IN-MAL-2026-017192","import_time":"2026-08-08T00:53:09.757446538Z","modified_time":"2026-08-08T00:51:24Z","sha256":"7babf0cc388e02d1f0b2939f1f68ce7b9714bc28c261932386300a3574d68397","source":"amazon-inspector"},{"sha256":"9ac7f0e3c2c3e7754640b213b01d06f9ed75d672d64c1011ed6172a5792c21a0","source":"amazon-inspector","versions":["1.9.66"],"id":"IN-MAL-2026-017182","import_time":"2026-08-08T00:53:09.127059274Z","modified_time":"2026-08-08T00:50:00Z"},{"modified_time":"2026-08-08T00:50:14Z","sha256":"9ee1f17b07ed88c1615d1570d311b968675bc579fc43e58fa72bf162f62dadb5","source":"amazon-inspector","versions":["1.9.67"],"id":"IN-MAL-2026-017184","import_time":"2026-08-08T00:53:09.251262574Z"},{"versions":["1.9.48"],"id":"IN-MAL-2026-017170","import_time":"2026-08-08T00:53:08.374982431Z","modified_time":"2026-08-08T00:48:09Z","sha256":"aa00d94088265daa445b5484137f5a8e3a642de907475f76618083fc21c562a8","source":"amazon-inspector"},{"modified_time":"2026-08-08T00:49:51Z","sha256":"b6f47205ab88810800770bb78e0bc408bc9ec3a7a4f25bf941f069241e1052cd","source":"amazon-inspector","versions":["1.9.26"],"id":"IN-MAL-2026-017181","import_time":"2026-08-08T00:53:09.068334722Z"},{"modified_time":"2026-08-08T00:50:49Z","sha256":"195ac70f37e1d413634857ce9b2028b4a6113f355b9b95893ac83db43918e590","source":"amazon-inspector","versions":["1.9.77"],"id":"IN-MAL-2026-017188","import_time":"2026-08-08T00:53:09.493865771Z"},{"import_time":"2026-08-08T00:53:08.621447576Z","modified_time":"2026-08-08T00:48:49Z","sha256":"4901552125568a59097d415d86ce33d8c58e34c310ff88e2c39e622a65a6004a","source":"amazon-inspector","versions":["1.9.44"],"id":"IN-MAL-2026-017174"},{"modified_time":"2026-08-08T00:48:17Z","sha256":"cd05293e460d530740baac9ed76214c8aebae2c1ec3e62a773f6d18201f23457","source":"amazon-inspector","versions":["1.9.53"],"id":"IN-MAL-2026-017171","import_time":"2026-08-08T00:53:08.449076803Z"},{"sha256":"ce8aac20108e18ccadc4f507a2c46d8c68e02e1d4120ed71b7ea34be497de71a","source":"amazon-inspector","versions":["1.9.29"],"id":"IN-MAL-2026-017180","import_time":"2026-08-08T00:53:09.00933501Z","modified_time":"2026-08-08T00:49:40Z"},{"modified_time":"2026-08-08T00:49:29Z","sha256":"e7dddfc8ef5507e863d3f9c5bfb41aa9f33c39576748180ed1f214a0e3b958fd","source":"amazon-inspector","versions":["1.9.40"],"id":"IN-MAL-2026-017179","import_time":"2026-08-08T00:53:08.950287222Z"},{"import_time":"2026-08-08T00:53:08.77036806Z","modified_time":"2026-08-08T00:49:07Z","sha256":"00eaee1d97d1213adb78e4d98f8a0e12b63a14aa047c2067790d0785d7f2dc29","source":"amazon-inspector","versions":["1.9.33"],"id":"IN-MAL-2026-017176"},{"id":"IN-MAL-2026-017178","import_time":"2026-08-08T00:53:08.888498598Z","modified_time":"2026-08-08T00:49:22Z","sha256":"96b9b67b6242662bc6764cc0477e0e068d57ca310d816c5f91fd76e2f61ec91b","source":"amazon-inspector","versions":["1.9.36"]},{"id":"IN-MAL-2026-017172","import_time":"2026-08-08T00:53:08.509226165Z","modified_time":"2026-08-08T00:48:26Z","sha256":"bfddf2f96157ec5e79aef8c1a3f8bee90cb95a160ec4ae5cec019f0a63429cab","source":"amazon-inspector","versions":["1.9.50"]},{"id":"IN-MAL-2026-017185","import_time":"2026-08-08T00:53:09.309117517Z","modified_time":"2026-08-08T00:50:25Z","sha256":"1a53d10f01aa0ae30707b0c4f940082ff6aa4ae8eb7d7261f8ce2be9a6236171","source":"amazon-inspector","versions":["1.9.71"]},{"source":"amazon-inspector","versions":["1.9.58"],"id":"IN-MAL-2026-017186","import_time":"2026-08-08T00:53:09.370468069Z","modified_time":"2026-08-08T00:50:32Z","sha256":"4b01add999e692277fe94d2e278051d1532c12ff73b569aea7013bd755ec1d7f"},{"sha256":"7f6774653f487db8fbb9b40f1c1aba2bf959edffae409445162b0d245a3bedf1","source":"amazon-inspector","versions":["1.9.79"],"id":"IN-MAL-2026-017191","import_time":"2026-08-08T00:53:09.696399081Z","modified_time":"2026-08-08T00:51:17Z"},{"id":"IN-MAL-2026-017177","import_time":"2026-08-08T00:53:08.826506434Z","modified_time":"2026-08-08T00:49:14Z","sha256":"87e50624a116710c2841131b9d46d28093c452498a2b58b4330e62a316e33fb4","source":"amazon-inspector","versions":["1.9.30"]},{"import_time":"2026-08-08T00:53:09.550911603Z","modified_time":"2026-08-08T00:50:58Z","sha256":"bfdc68ab10663e643ad339057a1e386c46e422f8eaa550cea595d068050dfbeb","source":"amazon-inspector","versions":["1.9.78"],"id":"IN-MAL-2026-017189"},{"modified_time":"2026-08-08T00:50:08Z","sha256":"d39f9ac9ca12736eaae21f8ec2a8a5b845ecdea82ef356b80521d1df95677d9a","source":"amazon-inspector","versions":["1.9.28"],"id":"IN-MAL-2026-017183","import_time":"2026-08-08T00:53:09.189059244Z"},{"id":"IN-MAL-2026-017187","import_time":"2026-08-08T00:53:09.430668235Z","modified_time":"2026-08-08T00:50:42Z","sha256":"efc4879d1133923b0f8cf97b5ee308ebc086f8379dff6196a0a2211bb958e248","source":"amazon-inspector","versions":["1.9.80"]},{"import_time":"2026-08-08T00:53:09.635296573Z","modified_time":"2026-08-08T00:51:08Z","sha256":"fba4521811f608f2adaa7cb5d4b68681ccd1cfc196c0da20db38127b98a2dc25","source":"amazon-inspector","versions":["1.9.25"],"id":"IN-MAL-2026-017190"},{"import_time":"2026-09-08T20:17:35.031914261Z","modified_time":"2026-09-08T19:55:03Z","sha256":"f8374c4b2e280cc37e57bee526d18562310edf3e4ec4b999d8554666279eebd8","source":"amazon-inspector","versions":["1.9.14"],"id":"IN-MAL-2026-019709"}],"iocs":{"files":[{"paths":["package/dist/telemetry-worker.bundle.mjs"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"2bd1173f8621e672128ffbdcf20536c8cc1a9f3cd39ece960a31f70173cd508f"},"note":"Bundled Lark/Feishu credential stealer worker (auto-started via launchd); keychain decryption + token POST (observed in 1.10.0)."},{"paths":["package/bin/lib/larkSecrets.mjs"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"2eb47cf8a23d796640ce11ac914a1671d58c8e339ccbd8670816a1a7864f1481"},"note":"Lark credential read/decrypt + upload logic invoked by the telemetry worker (observed in 1.10.0)."}]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.32"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.42"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.35"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.27"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.52"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.43"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.61"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.66"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.67"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.48"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.26"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.77"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.44"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.53"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.29"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.40"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.33"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.36"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.50"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.71"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.58"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.79"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.30"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.78"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.28"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.80"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.25"},{"type":"ADVISORY","url":"https://research.codelake.dev/advisories/clr-2026-3047-yancyyu-agentcli"},{"type":"ADVISORY","url":"https://osv.dev/vulnerability/MAL-2026-11123"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.14"}],"affected":[{"package":{"name":"@yancyyu/agentcli","ecosystem":"npm","purl":"pkg:npm/%40yancyyu/agentcli"},"versions":["1.9.32","1.9.42","1.9.35","1.9.27","1.9.52","1.9.43","1.9.61","1.9.66","1.9.67","1.9.48","1.9.26","1.9.77","1.9.44","1.9.53","1.9.29","1.9.40","1.9.33","1.9.36","1.9.50","1.9.71","1.9.58","1.9.79","1.9.30","1.9.78","1.9.28","1.9.80","1.9.25","1.9.9","1.9.10","1.9.11","1.9.12","1.9.13","1.9.14","1.9.15","1.9.16","1.9.17","1.9.18","1.9.19","1.9.20","1.9.21","1.9.22","1.9.23","1.9.24","1.10.0"],"database_specific":{"indicators":{"package_integrity":[{"filename":"agentcli-1.9.32.tgz","hashes":{"sha1":"3b3961d39eebced971f4edd462d30d8ec8f8dc30","sha512_sri":"sha512-fycNFjhGxFxgg/sT8sS72nsM0VG5ggqVCnvIdr/ueQQVTThcyX4CZMWF5qyahj7UMsNL0EAOTDni3XEg42WjqQ=="}}],"evidence_files":[{"path":"src/main/telemetry/larkCredentials.ts","sha256":"5a52412c69551bebfb8047d0f2fedc387630c01a3f670751eca0519bf6a1ff04","tlsh":"0823b79225ea14224d5371affa8fb812b21080076a5db8f5f6dc42587f4f06dd3f26da"},{"tlsh":"11217550b1f146a413910a36723ef7d2631aeb21dbe4f360a8a9434c3e550450373fe7","path":"src/shared/constants/cloudConfig.mjs","sha256":"2b2efe4adf8f2493cf5bbf976048fc39f913568246fc0d7f67d2ba8be94ae817"},{"sha256":"a9f32eb054744fb6f9c1abb831e006c9c88620fdc14911dfeb1057ff3bb49ca8","tlsh":"1dc2834310f6252849a753e7e56b9351af18ce132b0ab8a0f29d57251f1e88cf1f37e9","path":"src/main/telemetry/worker.ts"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@yancyyu/agentcli/MAL-2026-11123.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"codelake Research","contact":["https://research.codelake.dev/advisories/clr-2026-3047-yancyyu-agentcli"],"type":"FINDER"}]}