# MAL-2026-11123: Malicious code in @yancyyu/agentcli (npm)


- **Type:** Malicious package
- **Package:** `@yancyyu/agentcli` (npm)
- **Published:** 28 Jul 2026

## What is MAL-2026-11123?

MAL-2026-11123 is a malicious package in @yancyyu/agentcli, published on 28 Jul 2026. 

### Official description

The npm package `@yancyyu/agentcli` ships a Feishu/Lark credential stealer. An auto-started telemetry worker (`src/main/telemetry/worker.ts`, started via `agentcli init`/`agentcli usage start` and macOS launchd) calls `safeScanLarkCredentials()` in its periodic run loop; the scan reads and decrypts local Lark credentials (macOS Keychain AES-256-GCM `.enc` under `~/Library/Application Support/lark-cli/`, Windows DPAPI under `HKCU\Software\LarkCli\keychain`), refreshes tokens and POSTs {app_id, app_secret, access_token, refresh_token} to the operator backend (endpoint `/api/v1/report/lark-credentials`, later renamed `/api/v1/feishu/lark-cli/credentials`; default cloud hosts include `agentbus.skg.com`, `159.75.231.98:8088`, `47.112.24.153`).

These versions are not part of the existing OSV record MAL-2026-11123 (Amazon Inspector), which covers 1.9.25-1.9.80. The true malicious boundary is 1.9.9 (2026-07-12) via the import->call reachability chain (`telemetry/worker.ts` -> `larkCredentials`), 16 versions earlier than the previously-catalogued 1.9.25; the reachable credential theft is present continuously across 1.9.9-1.9.24 (each verified) and 1.10.0. Versions 1.8.8-1.9.8 exfiltrate local Claude/Codex conversations to the same backend but do not yet steal Lark credentials (out of scope for this malware record).

This report extends the confirmed-malicious set with 17 additional versions and an earlier boundary, scoped to the versions not yet listed in MAL-2026-11123 to avoid duplication. Determined by static code and dataflow review of the published npm tarballs.

The @yancyyu/agentcli package installs a telemetry worker (dist/telemetry-worker.bundle.mjs) that is started by `agentcli init` / `agentcli usage start` and auto-started via macOS launchd. The worker enumerates every lark-cli (Feishu) profile stored on the host — decrypting macOS Keychain-wrapped AES-256-GCM `.enc` files under `~/Library/Application Support/lark-cli/` and Windows DPAPI-protected values under `HKCU\Software\LarkCli\keychain` — refreshes each token, and batch-POSTs `{app_id, app_secret, access_token, refresh_token}` for every profile every 5 minutes to a hardcoded default endpoint `http://47.112.24.153` (plain HTTP, bare IPv4, no TLS). The endpoint constant `DEFAULT_OPENHERMIT_CLOUD_BASE_URL` is the single default for the credential batch upload and conversation/usage pipelines when no override env var or settings value is present. The enumeration is not limited to AgentCli-created profiles; every lark-cli profile on the machine is harvested. The `reportAllLarkCredentials` code comment states: "enumerate all personal lark-cli profiles, refresh each, then read current credentials [...] batch the complete eligible set to the server." The postinstall step additionally rewrites the optional `cc-connect` dependency's installer to prepend third-party China GitHub mirror hosts (gh-proxy.com, ghproxy.net) in front of upstream release URLs before the cc-connect native binary is downloaded and executed, broadening the trust boundary for that binary. Feishu (Lark) `app_id` + `app_secret` combined with valid access/refresh tokens allow full impersonation of the affected tenant applications; sending them cleartext to a bare IPv4 over HTTP additionally exposes them to any on-path observer.

## What should I do about MAL-2026-11123?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-11123 is a malicious package: @yancyyu/agentcli (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-11123/ (Markdown: https://insights.sbomify.com/MAL-2026-11123/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-11123

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-11123/
Summaries are generated and may contain mistakes; the official description above is the record.