@yancyyu/agentclinpm
@yancyyu/agentcli is a confirmed malicious npm package (MAL-2026-11123) that steals credentials and exfiltrates sensitive data (malicious versions 1.9.9, 1.9.10, 1.9.11…). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in @yancyyu/agentcli (npm)
What this malware does
The npm package @yancyyu/agentcli ships a Feishu/Lark credential stealer. An auto-started telemetry worker (src/main/telemetry/worker.ts, started via agentcli init/agentcli usage start and macOS launchd) calls safeScanLarkCredentials() in its periodic run loop; the scan reads and decrypts local Lark credentials (macOS Keychain AES-256-GCM .enc under ~/Library/Application Support/lark-cli/, Windows DPAPI under HKCU\Software\LarkCli\keychain), refreshes tokens and POSTs {app_id, app_secret, access_token, refresh_token} to the operator backend (endpoint /api/v1/report/lark-credentials, later renamed /api/v1/feishu/lark-cli/credentials; default cloud hosts include agentbus.skg.com, 159.75.231.98:8088, 47.112.24.153).
These versions are not part of the existing OSV record MAL-2026-11123 (Amazon Inspector), which covers 1.9.25-1.9.80. The true malicious boundary is 1.9.9 (2026-07-12) via the import->call reachability chain (telemetry/worker.ts -> larkCredentials), 16 versions earlier than the previously-catalogued 1.9.25; the reachable credential theft is present continuously across 1.9.9-1.9.24 (each verified) and 1.10.0. Versions 1.8.8-1.9.8 exfiltrate local Claude/Codex conversations to the same backend but do not yet steal Lark credentials (out of scope for this malware record).
This report extends the confirmed-malicious set with 17 additional versions and an earlier boundary, scoped to the versions not yet listed in MAL-2026-11123 to avoid duplication. Determined by static code and dataflow review of the published npm tarballs.
The @yancyyu/agentcli package installs a telemetry worker (dist/telemetry-worker.bundle.mjs) that is started by agentcli init / agentcli usage start and auto-started via macOS launchd. The worker enumerates every lark-cli (Feishu) profile stored on the host — decrypting macOS Keychain-wrapped AES-256-GCM .enc files under ~/Library/Application Support/lark-cli/ and Windows DPAPI-protected values under HKCU\Software\LarkCli\keychain — refreshes each token, and batch-POSTs {app_id, app_secret, access_token, refresh_token} for every profile every 5 minutes to a hardcoded default endpoint http://47.112.24.153 (plain HTTP, bare IPv4, no TLS). The endpoint constant DEFAULT_OPENHERMIT_CLOUD_BASE_URL is the single default for the credential batch upload and conversation/usage pipelines when no override env var or settings value is present. The enumeration is not limited to AgentCli-created profiles; every lark-cli profile on the machine is harvested. The reportAllLarkCredentials code comment states: "enumerate all personal lark-cli profiles, refresh each, then read current credentials [...] batch the complete eligible set to the server." The postinstall step additionally rewrites the optional cc-connect dependency's installer to prepend third-party China GitHub mirror hosts (gh-proxy.com, ghproxy.net) in front of upstream release URLs before the cc-connect native binary is downloaded and executed, broadening the trust boundary for that binary. Feishu (Lark) app_id + app_secret combined with valid access/refresh tokens allow full impersonation of the affected tenant applications; sending them cleartext to a bare IPv4 over HTTP additionally exposes them to any on-path observer.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Credential / info stealerFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @yancyyu/agentcli (44 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @yancyyu/agentcli across your stack and pipelines.
If you installed it — respond
@yancyyu/agentcli is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If @yancyyu/agentcli was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @yancyyu/agentcli before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
- codelake Research · finder
Detect & block this
O3 blocks @yancyyu/agentcli-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.