Malicious code in @yancyyu/agentcli (npm)

The @yancyyu/agentcli npm package was found to contain malicious code that targets credentials for the Lark/Feishu collaboration platform. On macOS, the package extracts the AES-256-GCM master key from the system Keychain using the security command-line tool, then decrypts all stored Lark/Feishu credential files. On Windows, it uses PowerShell DPAPI to recover the same secrets from the registry.\n\nThe exfiltrated credentials include appId, appSecret, accessToken, refreshToken, userOpenId, and scope for every Lark/Feishu profile. These are batched and sent via HTTP POST to a hardcoded IP address (47.112.24.153) over plaintext HTTP. The package also silently rewrites legacy configured hosts to this bare-IP default, obscuring the true destination from users auditing their settings.\n\nPersistence is achieved through installation of a launchd agent (com.openhermit.telemetry.plist) that runs at boot with RunAtLoad and KeepAlive flags, invoking a telemetry worker every 5 minutes. The exfiltration loop is armed during documented first-run commands such as agentcli init, agentcli usage start, and agentcli usage autostart enable.\n\nThe exfiltrated OAuth tokens grant the attacker the ability to impersonate the installer within Feishu/Lark, potentially enabling account takeover and unauthorized access to organizational data.