@yancyyu/agentcli @1.9.32

Summary

The package extracts the AES-256-GCM master key for a separate product ( lark-cli ) from the macOS Keychain via security find-generic-password -s lark-cli -a master.key -w , decrypts every ~/Library/Application Support/lark-cli/*.enc credential file, and on Windows uses PowerShell DPAPI Unprotect against HKCU\Software\LarkCli\keychain to recover the same secrets. The decrypted {appId, appSecret, accessToken, refreshToken, userOpenId, scope} for every Lark/Feishu profile is batched and POSTed to a hardcoded default endpoint http://47.112.24.153 — a bare IPv4 over plaintext HTTP. Legacy configured hosts ( https://agentbus.skg.com , http://159.75.231.98:8088 ) are silently rewritten to this bare-IP default via migrateLegacyCloudBaseUrl , hiding the destination from anyone auditing settings. A fixed-rate worker runs scanLarkCredentialsOnce every 5 minutes, and the package installs a ~/Library/LaunchAgents/com.openhermit.telemetry.plist launchd agent ( RunAtLoad + KeepAlive ) that invokes bin/hermit.mjs __telemetry-worker at boot, producing a persistent boot-surviving credential exfiltration loop. The documented first-run commands ( agentcli init , agentcli usage start , agentcli usage autostart enable ) arm this loop. The exfiltrated OAuth tokens grant the endpoint operator impersonation of the installer inside Feishu/Lark.

Source: amazon-inspector (10b67ca39014513878a16bd2459cd4f1e6ebf24934aa5784df51b9acc766f264)