⛔ Malware Advisory Detected 2026-09-03 · 11:30 UTC
Confirmed malicious. codelake independently detected this at 2026-09-03 · 11:30 UTC — codelake pins the confirmed-malicious boundary to 1.9.9 (2026-07-12) — 16 versions earlier than OSV MAL-2026-11123 (Amazon Inspector), which starts at 1.9.25 — via the verified telemetry-worker import->call chain. first-catch for 1.9.9-1.9.24 and 1.10.0; the package itself was previously disclosed by Amazon Inspector.. Also documented publicly: MAL-2026-11123 (OSV / Amazon Inspector, 2026-08-08). Verdicts from static code + dataflow review of the published npm tarballs; no execution or live callback.
Advisory · CLR-2026-3047

@yancyyu/agentcli — a Feishu/Lark credential stealer with a keychain-decrypting telemetry worker

An npm package that auto-starts a telemetry worker (via agentcli init and macOS launchd) which enumerates and decrypts local Lark/Feishu credentials from the OS keychain and POSTs app_id / app_secret / access_token / refresh_token to its backend. Earlier versions also exfiltrate local Claude/Codex conversations.

CriticalConfirmed maliciousLark credential theftKeychain decryptionlaunchd persistencecodelake first-catch · 17 versions
What it is

@yancyyu/agentcli presents as an agent/“digital worker” CLI. Underneath it ships a Feishu/Lark credential stealer.

A telemetry worker is auto-started by agentcli init / agentcli usage start and via macOS launchd — so it runs without an explicit user request.

Actor suite & infrastructure

The npm publisher yancyyu ships a coordinated suite around the same backend: @yancyyu/openhermit (the predecessor name), @yancyyu/agentcli, @yancyyu/agentpanel, plus hermit-bridge (bridges Claude Code / Cursor) and @yancyyu/agentbus (a launcher for a bundled native binary).

All of them phone telemetry/usage and local Claude/Codex conversations home to the same operator backend — default hosts agentbus.skg.com, 159.75.231.98:8088 (Tencent Cloud) and 47.112.24.153 (Alibaba Cloud) — via /api/v1/report/messages and /api/v1/report/usage. That collection layer is present across the suite (privacy-invasive; verdict suspicious).

Only agentcli escalates to credential theft. From 1.9.9 its telemetry worker additionally decrypts and exfiltrates Lark/Feishu credentials (malicious). openhermit 1.8.7 and agentpanel 1.10.4 carry the conversation-exfil layer but the Lark theft is not confirmed in their shipped builds — tracked as suspicious.

Behaviour (verified statically)

Credential theft (≥ 1.9.17). The worker reads and decrypts Lark credentials — macOS Keychain-wrapped AES-256-GCM .enc files under ~/Library/Application Support/lark-cli/ and Windows DPAPI values under HKCU\Software\LarkCli\keychain — refreshes tokens and POSTs {app_id, app_secret, access_token, refresh_token} to /api/v1/feishu/lark-cli/credentials. From 1.9.25 it batch-exfiltrates all Lark profiles, scanning immediately on start and periodically.

Conversation exfil (from 1.8.8, suspicious). Earlier versions collect local Claude/Codex conversations (including message content) and, when the upload config is enabled, send them to a hard-coded plaintext host 159.75.231.98:8088 at /api/v1/report/messages. No Lark theft yet at 1.8.8.

Timeline
2026-07-12
Malicious boundary
agentcli 1.9.9 introduces the reachable Lark-credential theft in the telemetry worker (16 versions before the catalogued 1.9.25).
2026-08-08
Prior disclosure
Amazon Inspector publishes OSV MAL-2026-11123 (versions 1.9.25–1.9.80).
2026-09-03
codelake first-catch
codelake confirms 1.9.17 and 1.10.0 malicious and moves the boundary earlier to 1.9.17.
2026-09-03
Published
Advisory CLR-2026-3047; OSV contribution prepared for the additional versions.
Indicators of compromise
🔑Lark credential exfil: POST /api/v1/report/lark-credentials (renamed /api/v1/feishu/lark-cli/credentials) — app_id, app_secret, access_token, refresh_token
🌐Operator backends: agentbus.skg.com, 159.75.231.98:8088 (Tencent CN), 47.112.24.153 (Alibaba CN)
💬Conversation/usage exfil: /api/v1/report/messages, /api/v1/report/usage (Claude/Codex conversation content)
🗝️macOS Keychain AES-256-GCM ~/Library/Application Support/lark-cli/*.enc · Windows DPAPI HKCU\Software\LarkCli\keychain
⚙️Auto-start: src/main/telemetry/worker.ts → safeScanLarkCredentials() in the run loop; autostart.ts / launchd; bundled dist/telemetry-worker.bundle.mjs
🧬1.10.0 dist/telemetry-worker.bundle.mjs sha256 2bd1173f8621e672128ffbdcf20536c8cc1a9f3cd39ece960a31f70173cd508f
📋Malicious (Lark theft): agentcli 1.9.9–1.10.0 (OSV MAL-2026-11123 covers 1.9.25–1.9.80; codelake adds 1.9.9–1.9.24 + 1.10.0). Suspicious (conversation exfil only): agentcli 1.8.8–1.9.8, openhermit 1.8.7, agentpanel 1.10.4.
Remediation
#ActionPriority
1 Uninstall @yancyyu/agentcli and remove any launchd LaunchAgent it installed. Immediate
2 Treat all Lark/Feishu app credentials and tokens on affected hosts as compromised — rotate app_secret and revoke tokens. Immediate
3 Hunt egress for /api/v1/feishu/lark-cli/credentials and connections to 159.75.231.98:8088. High
4 On hosts that ran it, review whether local Claude/Codex conversations were uploaded. High

Verified scope: an auto-started telemetry worker decrypts OS-keychain Lark credentials and POSTs them to the attacker backend (≥1.9.17); earlier versions exfiltrate local AI-assistant conversations. Analysis was static on the published npm tarballs; no execution.