The @yancyyu/agentcli npm package maliciously extracts the AES-256-GCM master key for the lark-cli product from the macOS Keychain using the 'security find-generic-password' command and decrypts credential files stored under '~/Library/Application Support/lark-cli/'. On Windows, it uses PowerShell DPAPI Unprotect to retrieve the same secrets from the registry. The decrypted credentials include appId, appSecret, accessToken, refreshToken, userOpenId, and scope for Lark/Feishu profiles. These credentials are batched and sent via HTTP POST to a hardcoded IPv4 address (http://47.112.24.153). Legacy hostnames are silently rewritten to this IP to obscure the exfiltration endpoint. A launchd agent is installed on macOS to run a telemetry worker at boot and keep it alive, creating a persistent exfiltration loop triggered by documented first-run commands. The stolen OAuth tokens allow the attacker to impersonate the installer within the Lark/Feishu environment.

The malicious package compromises user credentials for Lark/Feishu by extracting and exfiltrating OAuth tokens and secrets. This enables the attacker to impersonate the user within these platforms, potentially leading to unauthorized access, data theft, and further compromise of the victim's accounts and resources. The persistent agent ensures ongoing credential theft after initial installation.

No official patch or remediation is currently documented for this malicious package. Users should immediately uninstall @yancyyu/agentcli versions 1.9.27, 1.9.32, 1.9.35, and 1.9.42 if installed. Investigate and remove the macOS launchd agent 'com.openhermit.telemetry.plist' to stop persistent exfiltration. Avoid running the documented first-run commands that activate the credential theft loop. Monitor for suspicious network traffic to the IP 47.112.24.153 and related legacy hosts. Consider resetting compromised Lark/Feishu credentials and tokens. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.