{
  "schema_version": "1.6.0",
  "id": "CLR-2026-3047",
  "modified": "2026-09-03T11:30:00Z",
  "published": "2026-09-03T11:30:00Z",
  "summary": "@yancyyu/agentcli — a Feishu/Lark credential stealer with a keychain-decrypting telemetry worker",
  "details": "An npm package that auto-starts a telemetry worker (via agentcli init and macOS launchd) which enumerates and decrypts local Lark/Feishu credentials from the OS keychain and POSTs app_id / app_secret / access_token / refresh_token to its backend. Earlier versions also exfiltrate local Claude/Codex conversations.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@yancyyu/agentcli"
      },
      "versions": [
        "1.9.9–1.10.0"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-3047-yancyyu-agentcli"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/MAL-2026-11123"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-3047",
    "kind": "malware",
    "class": "Lark-credential stealer · conversation exfil",
    "severity": "Critical",
    "status": "Confirmed malicious",
    "iocs": {
      "ips": [
        "159.75.231.98",
        "47.112.24.153"
      ],
      "hashes": [
        "sha256:2bd1173f8621e672128ffbdcf20536c8cc1a9f3cd39ece960a31f70173cd508f"
      ],
      "indicators": [
        "Lark credential exfil: POST /api/v1/report/lark-credentials (renamed /api/v1/feishu/lark-cli/credentials) — app_id, app_secret, access_token, refresh_token",
        "Operator backends: agentbus.skg.com, 159.75.231.98:8088 (Tencent CN), 47.112.24.153 (Alibaba CN)",
        "Conversation/usage exfil: /api/v1/report/messages, /api/v1/report/usage (Claude/Codex conversation content)",
        "macOS Keychain AES-256-GCM ~/Library/Application Support/lark-cli/*.enc · Windows DPAPI HKCU\\Software\\LarkCli\\keychain",
        "Auto-start: src/main/telemetry/worker.ts → safeScanLarkCredentials() in the run loop; autostart.ts / launchd; bundled dist/telemetry-worker.bundle.mjs",
        "1.10.0 dist/telemetry-worker.bundle.mjs sha256 2bd1173f8621e672128ffbdcf20536c8cc1a9f3cd39ece960a31f70173cd508f",
        "Malicious (Lark theft): agentcli 1.9.9–1.10.0 (OSV MAL-2026-11123 covers 1.9.25–1.9.80; codelake adds 1.9.9–1.9.24 + 1.10.0). Suspicious (conversation exfil only): agentcli 1.8.8–1.9.8, openhermit 1.8.7, agentpanel 1.10.4."
      ]
    }
  }
}