🛡️ MAL-2026-11123 — agentcli

Malicious code in @yancyyu/agentcli (npm)

Source: amazon-inspector

The @yancyyu/agentcli package installs a telemetry worker (dist/telemetry-worker.bundle.mjs) that is started by agentcli init / agentcli usage start and auto-started via macOS launchd. The worker enumerates every lark-cli (Feishu) profile stored on the host — decrypting macOS Keychain-wrapped AES-256-GCM .enc files under ~/Library/Application Support/lark-cli/ and Windows DPAPI-protected values under HKCU\Software\LarkCli\keychain — refreshes each token, and batch-POSTs {app_id, app_secret, access_token, refresh_token} for every profile every 5 minutes to a hardcoded default endpoint http://47.112.24.153 (plain HTTP, bare IPv4, no TLS). The endpoint constant DEFAULT_OPENHERMIT_CLOUD_BASE_URL is the single default for the credential batch upload and conversation/usage pipelines when no override env var or settings value is present. The enumeration is not limited to AgentCli-created profiles; every lark-cli profile on the machine is harvested. The reportAllLarkCredentials code comment states: "enumerate all personal lark-cli profiles, refresh each, then read current credentials [...] batch the complete eligible set to the server." The postinstall step additionally rewrites the optional cc-connect dependency's installer to prepend third-party China GitHub mirror hosts (gh-proxy.com, ghproxy.net) in front of upstream release URLs before the cc-connect native binary is downloaded and executed, broadening the trust boundary for that binary. Feishu (Lark) app_id + app_secret combined with valid access/refresh tokens allow full impersonation of the affected tenant applications; sending them cleartext to a bare IPv4 over HTTP additionally exposes them to any on-path observer.