@yancyyu/agentcli (published by the account yancyyu) presents as an AI engineering collaboration platform, branded AgentCli and Hermit, with a working command-line interface and a stated purpose that includes usage collection. The package is roughly 169 MB unpacked across more than 1,200 files, most of that weight in bundled per-platform native binaries. About sixty-five versions shipped in the twenty-seven days between July 2 and July 29, 2026.
Inside the working tool is a routine that reads another application’s protected credentials. It extracts the four secrets the Lark command-line client keeps under operating-system protection, refreshes them against the real Lark login service so they stay valid, and posts them to a backend the code names AgentBus. On install, a lifecycle hook writes into the developer’s Claude Code configuration directory.
The artifact
The package ships a working command-line entry point (bin/hermit.mjs), a feature set that matches its README, and a runtime bridge called cc-connect delivered as compiled binaries for each platform under vendor/cc-connect. Those binaries are the bulk of the 169 MB.
The account has published this single package, iterating it at roughly sixty-five versions in under a month. Rapid version turnover on a package that reads protected credentials points to active payload development.
What the installer changes
The postinstall hook in bin/postinstall.mjs runs on npm install. It seeds files into ~/.claude/workflow, the directory the Claude Code assistant reads its workflows from, and it rewrites a bundled cc-connect installer so the binary is fetched through mirror hosts. Writing into the assistant’s own configuration directory changes what the developer’s agent will load, without the developer choosing it.
What it reads
The credential routine lives in bin/lib/larkSecrets.mjs, which delegates to src/main/telemetry/larkCredentials.ts. Its stated task is to pull the four Lark client secrets out of the Lark client’s own local store, which that client deliberately never prints in the clear. The four are an application id, an application secret, an access token, and a refresh token.
On macOS it decrypts the store’s AES-256-GCM master key from the system Keychain, under the service name lark-cli and the account master.key, then decrypts the token files that key protects. On Windows it unprotects the values through DPAPI by invoking PowerShell. The access token grants immediate as-user access to the victim’s Feishu account, and the refresh token extends that access well past the access token’s short lifetime.
How it leaves
With the tokens recovered, the routine refreshes each one against the real Feishu login endpoint. That step mints a fresh access token from the stolen refresh token and keeps the theft usable past the point where the original session would have expired. It batches the results and posts them to a backend endpoint the code names AgentBus, at /api/v1/feishu/lark-cli/credentials/batch, with the base address read from an AGENTBUS_ENDPOINT variable. The report runs through a long-lived telemetry process rather than a single call, and the code suppresses the child process standard-error stream because, by its own comment, that stream can carry the reflected request bodies.
The operation
This is one publishing account running one productized tool, iterated at roughly sixty-five versions in under a month. The polished branding and the working feature set make the package read as a legitimate product on inspection, while the credential routine sits inside a telemetry module rather than anywhere a reader would look first. At 169 MB the package exceeds the size limit of many review pipelines, so the code inside those binaries falls outside most review pipelines entirely.
What a defender can do
Search lockfiles for @yancyyu/agentcli. If it resolved on a developer machine, treat that developer’s Lark and Feishu session as compromised and revoke the client’s tokens at the identity provider, because the refresh token grants continued access until it is revoked there rather than locally. Inspect ~/.claude/workflow for files the postinstall hook seeded, and review what the assistant has been loading since the install.
Setting ignore-scripts=true blocks the postinstall hook, but it does not block the credential routine, which runs from the tool’s own commands and its telemetry process once the developer starts using it. Decrypting another application’s protected keychain entries and posting them to its own backend is credential collection whatever the marketing says.
Where Aephix fits
The size of this package puts the credential-harvesting code beyond what a quick review catches. Weekly Sleuth reports the week’s confirmed artifacts grouped by the operation behind them, so the next branded product from this publisher reaches subscribers already linked to this one. Aephix Vantage gives you a free cross-ecosystem check before you install.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| npm package | @yancyyu/agentcli | AI collaboration CLI carrying the credential routine |
| npm account | yancyyu | Publisher of the package |
| CLI entry | bin/hermit.mjs | Command-line entry point (AgentCli / Hermit branding) |
| Install hook | postinstall seeds ~/.claude/workflow | Writes into the Claude Code workflow directory |
| Credential source (macOS) | Keychain service lark-cli, account master.key | AES-256-GCM master key for the Lark client store |
| Credential source (Windows) | HKCU Software\LarkCli\keychain via DPAPI | PowerShell unprotect of the Lark client secrets |
| Stolen secrets | appId, appSecret, accessToken, refreshToken | Grant as-user access to the victim Feishu account |
| Token refresh | Real Feishu OAuth endpoint | Keeps the stolen tokens valid past expiry |
| Exfil endpoint | /api/v1/feishu/lark-cli/credentials/batch | AgentBus backend, base from AGENTBUS_ENDPOINT |
| Bundled binaries | vendor/cc-connect//cc-connect | Native runtime bridge, bulk of the 169 MB |