@yancyyu/agentcli (published by the account yancyyu) presents as an AI engineering collaboration platform, branded AgentCli and Hermit, with a working command-line interface and a stated purpose that includes usage collection. The package is roughly 169 MB unpacked across more than 1,200 files, most of that weight in bundled per-platform native binaries. About sixty-five versions shipped in the twenty-seven days between July 2 and July 29, 2026.
Inside the working tool is a routine that reads another application’s protected credentials. It extracts the four secrets the Lark command-line client keeps under operating-system protection, refreshes them against the real Lark login service so they stay valid, and posts them to a backend the code names AgentBus. On install, a lifecycle hook writes into the developer’s Claude Code configuration directory.
The artifact
The package installs a real tool. It ships a command-line entry point (bin/hermit.mjs), a feature set that matches its README, and a runtime bridge called cc-connect delivered as compiled binaries for each platform under vendor/cc-connect. Those binaries are the bulk of the 169 MB. A working product on the surface is what carries the credential routine past a casual read.
The account has published this single package, iterating it at roughly sixty-five versions in under a month. Rapid version turnover on a package that reads protected credentials is the kind of cadence that indicates active development of the payload, not settled maintenance.
What the installer changes
The postinstall hook in bin/postinstall.mjs runs on npm install. It seeds files into ~/.claude/workflow, the directory the Claude Code assistant reads its workflows from, and it rewrites a bundled cc-connect installer so the binary is fetched through mirror hosts. Writing into the assistant’s own configuration directory changes what the developer’s agent will load, without the developer choosing it.
What it reads
The credential routine lives in bin/lib/larkSecrets.mjs, which delegates to src/main/telemetry/larkCredentials.ts. Its stated task is to pull the four Lark client secrets out of the Lark client’s own local store, which that client deliberately never prints in the clear. The four are an application id, an application secret, an access token, and a refresh token.
On macOS it decrypts the store’s AES-256-GCM master key from the system Keychain, under the service name lark-cli and the account master.key, then decrypts the token files that key protects. On Windows it unprotects the values through DPAPI by invoking PowerShell. The access token grants immediate as-user access to the victim’s Feishu account, and the refresh token extends that access well past the access token’s short lifetime.
How it leaves
With the tokens recovered, the routine refreshes each one against the real Feishu login endpoint. That step mints a fresh access token from the stolen refresh token and keeps the theft usable past the point where the original session would have expired. It batches the results and posts them to a backend endpoint the code names AgentBus, at /api/v1/feishu/lark-cli/credentials/batch, with the base address read from an AGENTBUS_ENDPOINT variable. The report runs through a long-lived telemetry process rather than a single call, and the code suppresses the child process standard-error stream because, by its own comment, that stream can carry the reflected request bodies.
The operation
This is one publishing account running one productized tool, iterated at roughly sixty-five versions in under a month. The polished branding and the working feature set make the package read as a legitimate product on inspection, while the credential routine sits inside a telemetry module rather than anywhere a reader would look first. The bundled native binaries deserve their own note. At 169 MB the package sits above the size ceiling of many review pipelines, so the code most people never fetch is also the code least likely to be examined. Size by itself moved this package out of view.
What a defender can do
Search lockfiles for @yancyyu/agentcli. If it resolved on a developer machine, treat that developer’s Lark and Feishu session as compromised and revoke the client’s tokens at the identity provider, because the refresh token grants continued access until it is revoked there rather than locally. Inspect ~/.claude/workflow for files the postinstall hook seeded, and review what the assistant has been loading since the install.
Setting ignore-scripts=true blocks the postinstall hook, but it does not block the credential routine, which runs from the tool’s own commands and its telemetry process once the developer starts using it. A component that decrypts another application’s protected keychain entries and posts them to its own backend is performing credential collection whatever its marketing says.
Where Aephix fits
A polished tool with a real feature set is the hardest kind of malicious package to judge from its own code, and the size of this one puts the relevant code beyond a size-capped read. Aephix is threat intelligence for the AI agent supply chain. It is not a patch or a sandbox. Before you install a package or connect to a server, Aephix Vantage gives you a free, cross-ecosystem view of what is already known to be malicious, so a credential harvester wearing product branding is something you recognize before you connect. When you are looking at a malicious package, model, skill, MCP server, extension, or container, Aephix Sleuth links it to the wider operation behind it, with a confidence level and supporting evidence, so you can act against the operation rather than the single artifact.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| npm package | @yancyyu/agentcli | AI collaboration CLI carrying the credential routine |
| npm account | yancyyu | Publisher of the package |
| CLI entry | bin/hermit.mjs | Command-line entry point (AgentCli / Hermit branding) |
| Install hook | postinstall seeds ~/.claude/workflow | Writes into the Claude Code workflow directory |
| Credential source (macOS) | Keychain service lark-cli, account master.key | AES-256-GCM master key for the Lark client store |
| Credential source (Windows) | HKCU Software\LarkCli\keychain via DPAPI | PowerShell unprotect of the Lark client secrets |
| Stolen secrets | appId, appSecret, accessToken, refreshToken | Grant as-user access to the victim Feishu account |
| Token refresh | Real Feishu OAuth endpoint | Keeps the stolen tokens valid past expiry |
| Exfil endpoint | /api/v1/feishu/lark-cli/credentials/batch | AgentBus backend, base from AGENTBUS_ENDPOINT |
| Bundled binaries | vendor/cc-connect//cc-connect | Native runtime bridge, bulk of the 169 MB |