MAL-2026-11123

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@yancyyu/agentcli/MAL-2026-11123.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-11123

Published

2026-07-28T13:30:51Z

Modified

2026-09-08T20:30:09Z

Summary

Malicious code in @yancyyu/agentcli (npm)

Details

The npm package @yancyyu/agentcli ships a Feishu/Lark credential stealer. An auto-started telemetry worker (src/main/telemetry/worker.ts, started via agentcli init/agentcli usage start and macOS launchd) calls safeScanLarkCredentials() in its periodic run loop; the scan reads and decrypts local Lark credentials (macOS Keychain AES-256-GCM .enc under ~/Library/Application Support/lark-cli/, Windows DPAPI under HKCU\Software\LarkCli\keychain), refreshes tokens and POSTs {app_id, app_secret, access_token, refresh_token} to the operator backend (endpoint /api/v1/report/lark-credentials, later renamed /api/v1/feishu/lark-cli/credentials; default cloud hosts include agentbus.skg.com, 159.75.231.98:8088, 47.112.24.153).

These versions were identified independently by codelake Research and are NOT part of the existing OSV record MAL-2026-11123 (Amazon Inspector), which covers 1.9.25-1.9.80. codelake pins the true malicious boundary at 1.9.9 (2026-07-12) via the import->call reachability chain (telemetry/worker.ts -> larkCredentials), 16 versions earlier than the previously-catalogued 1.9.25; the reachable credential theft is present continuously across 1.9.9-1.9.24 (each verified) and 1.10.0. Versions 1.8.8-1.9.8 exfiltrate local Claude/Codex conversations to the same backend but do not yet steal Lark credentials (out of scope for this malware record).

Classified by codelake Research from static code + dataflow review of the published npm tarballs. This report extends the confirmed-malicious set with 17 additional versions and an earlier boundary; codelake independently detected the package across its full malicious range (including the versions already in MAL-2026-11123) and scopes this report to the not-yet-listed versions to avoid duplication.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7f6774653f487db8fbb9b40f1c1aba2bf959edffae409445162b0d245a3bedf1)

The @yancyyu/agentcli package installs a telemetry worker (dist/telemetry-worker.bundle.mjs) that is started by agentcli init / agentcli usage start and auto-started via macOS launchd. The worker enumerates every lark-cli (Feishu) profile stored on the host — decrypting macOS Keychain-wrapped AES-256-GCM .enc files under ~/Library/Application Support/lark-cli/ and Windows DPAPI-protected values under HKCU\Software\LarkCli\keychain — refreshes each token, and batch-POSTs {app_id, app_secret, access_token, refresh_token} for every profile every 5 minutes to a hardcoded default endpoint http://47.112.24.153 (plain HTTP, bare IPv4, no TLS). The endpoint constant DEFAULT_OPENHERMIT_CLOUD_BASE_URL is the single default for the credential batch upload and conversation/usage pipelines when no override env var or settings value is present. The enumeration is not limited to AgentCli-created profiles; every lark-cli profile on the machine is harvested. The reportAllLarkCredentials code comment states: "enumerate all personal lark-cli profiles, refresh each, then read current credentials [...] batch the complete eligible set to the server." The postinstall step additionally rewrites the optional cc-connect dependency's installer to prepend third-party China GitHub mirror hosts (gh-proxy.com, ghproxy.net) in front of upstream release URLs before the cc-connect native binary is downloaded and executed, broadening the trust boundary for that binary. Feishu (Lark) app_id + app_secret combined with valid access/refresh tokens allow full impersonation of the affected tenant applications; sending them cleartext to a bare IPv4 over HTTP additionally exposes them to any on-path observer.

Database specific

{
    "iocs": {
        "files": [
            {
                "digests": {
                    "sha256": "2bd1173f8621e672128ffbdcf20536c8cc1a9f3cd39ece960a31f70173cd508f"
                },
                "note": "Bundled Lark/Feishu credential stealer worker (auto-started via launchd); keychain decryption + token POST (observed in 1.10.0).",
                "paths": [
                    "package/dist/telemetry-worker.bundle.mjs"
                ],
                "source": "PACKAGE_ARCHIVE"
            },
            {
                "digests": {
                    "sha256": "2eb47cf8a23d796640ce11ac914a1671d58c8e339ccbd8670816a1a7864f1481"
                },
                "note": "Lark credential read/decrypt + upload logic invoked by the telemetry worker (observed in 1.10.0).",
                "paths": [
                    "package/bin/lib/larkSecrets.mjs"
                ],
                "source": "PACKAGE_ARCHIVE"
            }
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010879",
            "import_time": "2026-07-28T14:19:57.174630207Z",
            "modified_time": "2026-07-28T13:30:51Z",
            "sha256": "10b67ca39014513878a16bd2459cd4f1e6ebf24934aa5784df51b9acc766f264",
            "source": "amazon-inspector",
            "versions": [
                "1.9.32"
            ]
        },
        {
            "id": "IN-MAL-2026-014789",
            "import_time": "2026-08-05T13:08:46.640961459Z",
            "modified_time": "2026-08-05T12:51:30Z",
            "sha256": "7a6db15f3c61b8f2b394478af94c4b9f58cdce9f5007012b8e0e5b883f8ccb81",
            "source": "amazon-inspector",
            "versions": [
                "1.9.42"
            ]
        },
        {
            "id": "IN-MAL-2026-014814",
            "import_time": "2026-08-05T13:08:48.527862019Z",
            "modified_time": "2026-08-05T12:56:07Z",
            "sha256": "88391b25e025074f89b9807478519246f9b12a7ad1929a0a04c4ba12eddf9a07",
            "source": "amazon-inspector",
            "versions": [
                "1.9.35"
            ]
        },
        {
            "id": "IN-MAL-2026-014800",
            "import_time": "2026-08-05T13:08:47.405694498Z",
            "modified_time": "2026-08-05T12:53:12Z",
            "sha256": "f9b6bcbf02d925d1138d0cedb9d31e8c78792d419bb0f1f165ac721b2a358803",
            "source": "amazon-inspector",
            "versions": [
                "1.9.27"
            ]
        },
        {
            "id": "IN-MAL-2026-017173",
            "import_time": "2026-08-08T00:53:08.565570322Z",
            "modified_time": "2026-08-08T00:48:36Z",
            "sha256": "56ca7986e94bf6014ed0c7aa7402d3c6db6e8f6de75d630f261465203cfc3cb7",
            "source": "amazon-inspector",
            "versions": [
                "1.9.52"
            ]
        },
        {
            "id": "IN-MAL-2026-017175",
            "import_time": "2026-08-08T00:53:08.711795544Z",
            "modified_time": "2026-08-08T00:48:59Z",
            "sha256": "56d4294e5480488e46551a40136052a1dd16c42720ea2509835db2d5fafc03a8",
            "source": "amazon-inspector",
            "versions": [
                "1.9.43"
            ]
        },
        {
            "id": "IN-MAL-2026-017192",
            "import_time": "2026-08-08T00:53:09.757446538Z",
            "modified_time": "2026-08-08T00:51:24Z",
            "sha256": "7babf0cc388e02d1f0b2939f1f68ce7b9714bc28c261932386300a3574d68397",
            "source": "amazon-inspector",
            "versions": [
                "1.9.61"
            ]
        },
        {
            "id": "IN-MAL-2026-017182",
            "import_time": "2026-08-08T00:53:09.127059274Z",
            "modified_time": "2026-08-08T00:50:00Z",
            "sha256": "9ac7f0e3c2c3e7754640b213b01d06f9ed75d672d64c1011ed6172a5792c21a0",
            "source": "amazon-inspector",
            "versions": [
                "1.9.66"
            ]
        },
        {
            "id": "IN-MAL-2026-017184",
            "import_time": "2026-08-08T00:53:09.251262574Z",
            "modified_time": "2026-08-08T00:50:14Z",
            "sha256": "9ee1f17b07ed88c1615d1570d311b968675bc579fc43e58fa72bf162f62dadb5",
            "source": "amazon-inspector",
            "versions": [
                "1.9.67"
            ]
        },
        {
            "id": "IN-MAL-2026-017170",
            "import_time": "2026-08-08T00:53:08.374982431Z",
            "modified_time": "2026-08-08T00:48:09Z",
            "sha256": "aa00d94088265daa445b5484137f5a8e3a642de907475f76618083fc21c562a8",
            "source": "amazon-inspector",
            "versions": [
                "1.9.48"
            ]
        },
        {
            "id": "IN-MAL-2026-017181",
            "import_time": "2026-08-08T00:53:09.068334722Z",
            "modified_time": "2026-08-08T00:49:51Z",
            "sha256": "b6f47205ab88810800770bb78e0bc408bc9ec3a7a4f25bf941f069241e1052cd",
            "source": "amazon-inspector",
            "versions": [
                "1.9.26"
            ]
        },
        {
            "id": "IN-MAL-2026-017188",
            "import_time": "2026-08-08T00:53:09.493865771Z",
            "modified_time": "2026-08-08T00:50:49Z",
            "sha256": "195ac70f37e1d413634857ce9b2028b4a6113f355b9b95893ac83db43918e590",
            "source": "amazon-inspector",
            "versions": [
                "1.9.77"
            ]
        },
        {
            "id": "IN-MAL-2026-017174",
            "import_time": "2026-08-08T00:53:08.621447576Z",
            "modified_time": "2026-08-08T00:48:49Z",
            "sha256": "4901552125568a59097d415d86ce33d8c58e34c310ff88e2c39e622a65a6004a",
            "source": "amazon-inspector",
            "versions": [
                "1.9.44"
            ]
        },
        {
            "id": "IN-MAL-2026-017171",
            "import_time": "2026-08-08T00:53:08.449076803Z",
            "modified_time": "2026-08-08T00:48:17Z",
            "sha256": "cd05293e460d530740baac9ed76214c8aebae2c1ec3e62a773f6d18201f23457",
            "source": "amazon-inspector",
            "versions": [
                "1.9.53"
            ]
        },
        {
            "id": "IN-MAL-2026-017180",
            "import_time": "2026-08-08T00:53:09.00933501Z",
            "modified_time": "2026-08-08T00:49:40Z",
            "sha256": "ce8aac20108e18ccadc4f507a2c46d8c68e02e1d4120ed71b7ea34be497de71a",
            "source": "amazon-inspector",
            "versions": [
                "1.9.29"
            ]
        },
        {
            "id": "IN-MAL-2026-017179",
            "import_time": "2026-08-08T00:53:08.950287222Z",
            "modified_time": "2026-08-08T00:49:29Z",
            "sha256": "e7dddfc8ef5507e863d3f9c5bfb41aa9f33c39576748180ed1f214a0e3b958fd",
            "source": "amazon-inspector",
            "versions": [
                "1.9.40"
            ]
        },
        {
            "id": "IN-MAL-2026-017176",
            "import_time": "2026-08-08T00:53:08.77036806Z",
            "modified_time": "2026-08-08T00:49:07Z",
            "sha256": "00eaee1d97d1213adb78e4d98f8a0e12b63a14aa047c2067790d0785d7f2dc29",
            "source": "amazon-inspector",
            "versions": [
                "1.9.33"
            ]
        },
        {
            "id": "IN-MAL-2026-017178",
            "import_time": "2026-08-08T00:53:08.888498598Z",
            "modified_time": "2026-08-08T00:49:22Z",
            "sha256": "96b9b67b6242662bc6764cc0477e0e068d57ca310d816c5f91fd76e2f61ec91b",
            "source": "amazon-inspector",
            "versions": [
                "1.9.36"
            ]
        },
        {
            "id": "IN-MAL-2026-017172",
            "import_time": "2026-08-08T00:53:08.509226165Z",
            "modified_time": "2026-08-08T00:48:26Z",
            "sha256": "bfddf2f96157ec5e79aef8c1a3f8bee90cb95a160ec4ae5cec019f0a63429cab",
            "source": "amazon-inspector",
            "versions": [
                "1.9.50"
            ]
        },
        {
            "id": "IN-MAL-2026-017185",
            "import_time": "2026-08-08T00:53:09.309117517Z",
            "modified_time": "2026-08-08T00:50:25Z",
            "sha256": "1a53d10f01aa0ae30707b0c4f940082ff6aa4ae8eb7d7261f8ce2be9a6236171",
            "source": "amazon-inspector",
            "versions": [
                "1.9.71"
            ]
        },
        {
            "id": "IN-MAL-2026-017186",
            "import_time": "2026-08-08T00:53:09.370468069Z",
            "modified_time": "2026-08-08T00:50:32Z",
            "sha256": "4b01add999e692277fe94d2e278051d1532c12ff73b569aea7013bd755ec1d7f",
            "source": "amazon-inspector",
            "versions": [
                "1.9.58"
            ]
        },
        {
            "id": "IN-MAL-2026-017191",
            "import_time": "2026-08-08T00:53:09.696399081Z",
            "modified_time": "2026-08-08T00:51:17Z",
            "sha256": "7f6774653f487db8fbb9b40f1c1aba2bf959edffae409445162b0d245a3bedf1",
            "source": "amazon-inspector",
            "versions": [
                "1.9.79"
            ]
        },
        {
            "id": "IN-MAL-2026-017177",
            "import_time": "2026-08-08T00:53:08.826506434Z",
            "modified_time": "2026-08-08T00:49:14Z",
            "sha256": "87e50624a116710c2841131b9d46d28093c452498a2b58b4330e62a316e33fb4",
            "source": "amazon-inspector",
            "versions": [
                "1.9.30"
            ]
        },
        {
            "id": "IN-MAL-2026-017189",
            "import_time": "2026-08-08T00:53:09.550911603Z",
            "modified_time": "2026-08-08T00:50:58Z",
            "sha256": "bfdc68ab10663e643ad339057a1e386c46e422f8eaa550cea595d068050dfbeb",
            "source": "amazon-inspector",
            "versions": [
                "1.9.78"
            ]
        },
        {
            "id": "IN-MAL-2026-017183",
            "import_time": "2026-08-08T00:53:09.189059244Z",
            "modified_time": "2026-08-08T00:50:08Z",
            "sha256": "d39f9ac9ca12736eaae21f8ec2a8a5b845ecdea82ef356b80521d1df95677d9a",
            "source": "amazon-inspector",
            "versions": [
                "1.9.28"
            ]
        },
        {
            "id": "IN-MAL-2026-017187",
            "import_time": "2026-08-08T00:53:09.430668235Z",
            "modified_time": "2026-08-08T00:50:42Z",
            "sha256": "efc4879d1133923b0f8cf97b5ee308ebc086f8379dff6196a0a2211bb958e248",
            "source": "amazon-inspector",
            "versions": [
                "1.9.80"
            ]
        },
        {
            "id": "IN-MAL-2026-017190",
            "import_time": "2026-08-08T00:53:09.635296573Z",
            "modified_time": "2026-08-08T00:51:08Z",
            "sha256": "fba4521811f608f2adaa7cb5d4b68681ccd1cfc196c0da20db38127b98a2dc25",
            "source": "amazon-inspector",
            "versions": [
                "1.9.25"
            ]
        },
        {
            "id": "IN-MAL-2026-019709",
            "import_time": "2026-09-08T20:17:35.031914261Z",
            "modified_time": "2026-09-08T19:55:03Z",
            "sha256": "f8374c4b2e280cc37e57bee526d18562310edf3e4ec4b999d8554666279eebd8",
            "source": "amazon-inspector",
            "versions": [
                "1.9.14"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com
- codelake Research - FINDER
- - https://research.codelake.dev/advisories/clr-2026-3047-yancyyu-agentcli

Affected packages

npm / @yancyyu/agentcli

Package

Name: @yancyyu/agentcli; View open source insights on deps.dev
Purl: pkg:npm/%40yancyyu/agentcli

Affected ranges

Affected versions

1.*

1.9.9

1.9.10

1.9.11

1.9.12

1.9.13

1.9.14

1.9.15

1.9.16

1.9.17

1.9.18

1.9.19

1.9.20

1.9.21

1.9.22

1.9.23

1.9.24

1.9.25

1.9.26

1.9.27

1.9.28

1.9.29

1.9.30

1.9.32

1.9.33

1.9.35

1.9.36

1.9.40

1.9.42

1.9.43

1.9.44

1.9.48

1.9.50

1.9.52

1.9.53

1.9.58

1.9.61

1.9.66

1.9.67

1.9.71

1.9.77

1.9.78

1.9.79

1.9.80

1.10.0

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files": [
        {
            "path": "src/main/telemetry/larkCredentials.ts",
            "sha256": "5a52412c69551bebfb8047d0f2fedc387630c01a3f670751eca0519bf6a1ff04",
            "tlsh": "0823b79225ea14224d5371affa8fb812b21080076a5db8f5f6dc42587f4f06dd3f26da"
        },
        {
            "path": "src/shared/constants/cloudConfig.mjs",
            "sha256": "2b2efe4adf8f2493cf5bbf976048fc39f913568246fc0d7f67d2ba8be94ae817",
            "tlsh": "11217550b1f146a413910a36723ef7d2631aeb21dbe4f360a8a9434c3e550450373fe7"
        },
        {
            "path": "src/main/telemetry/worker.ts",
            "sha256": "a9f32eb054744fb6f9c1abb831e006c9c88620fdc14911dfeb1057ff3bb49ca8",
            "tlsh": "1dc2834310f6252849a753e7e56b9351af18ce132b0ab8a0f29d57251f1e88cf1f37e9"
        }
    ],
    "package_integrity": [
        {
            "filename": "agentcli-1.9.32.tgz",
            "hashes": {
                "sha1": "3b3961d39eebced971f4edd462d30d8ec8f8dc30",
                "sha512_sri": "sha512-fycNFjhGxFxgg/sT8sS72nsM0VG5ggqVCnvIdr/ueQQVTThcyX4CZMWF5qyahj7UMsNL0EAOTDni3XEg42WjqQ=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@yancyyu/agentcli/MAL-2026-11123.json"