mal-2026-11123
Vulnerability from ossf_malicious_packages
Published
2026-07-28 13:30
Modified
2026-08-08 00:55
Summary
Malicious code in @yancyyu/agentcli (npm)
Details
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (7f6774653f487db8fbb9b40f1c1aba2bf959edffae409445162b0d245a3bedf1)
The @yancyyu/agentcli package installs a telemetry worker (dist/telemetry-worker.bundle.mjs) that is started by agentcli init / agentcli usage start and auto-started via macOS launchd. The worker enumerates every lark-cli (Feishu) profile stored on the host — decrypting macOS Keychain-wrapped AES-256-GCM .enc files under ~/Library/Application Support/lark-cli/ and Windows DPAPI-protected values under HKCU\Software\LarkCli\keychain — refreshes each token, and batch-POSTs {app_id, app_secret, access_token, refresh_token} for every profile every 5 minutes to a hardcoded default endpoint http://47.112.24.153 (plain HTTP, bare IPv4, no TLS). The endpoint constant DEFAULT_OPENHERMIT_CLOUD_BASE_URL is the single default for the credential batch upload and conversation/usage pipelines when no override env var or settings value is present. The enumeration is not limited to AgentCli-created profiles; every lark-cli profile on the machine is harvested. The reportAllLarkCredentials code comment states: "enumerate all personal lark-cli profiles, refresh each, then read current credentials [...] batch the complete eligible set to the server." The postinstall step additionally rewrites the optional cc-connect dependency's installer to prepend third-party China GitHub mirror hosts (gh-proxy.com, ghproxy.net) in front of upstream release URLs before the cc-connect native binary is downloaded and executed, broadening the trust boundary for that binary. Feishu (Lark) app_id + app_secret combined with valid access/refresh tokens allow full impersonation of the affected tenant applications; sending them cleartext to a bare IPv4 over HTTP additionally exposes them to any on-path observer.
CWE
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
Credits
{
"affected": [
{
"database_specific": {
"cwes": [
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
}
],
"indicators": {
"evidence_files": [
{
"path": "src/main/telemetry/larkCredentials.ts",
"sha256": "5a52412c69551bebfb8047d0f2fedc387630c01a3f670751eca0519bf6a1ff04",
"tlsh": "0823b79225ea14224d5371affa8fb812b21080076a5db8f5f6dc42587f4f06dd3f26da"
},
{
"path": "src/shared/constants/cloudConfig.mjs",
"sha256": "2b2efe4adf8f2493cf5bbf976048fc39f913568246fc0d7f67d2ba8be94ae817",
"tlsh": "11217550b1f146a413910a36723ef7d2631aeb21dbe4f360a8a9434c3e550450373fe7"
},
{
"path": "src/main/telemetry/worker.ts",
"sha256": "a9f32eb054744fb6f9c1abb831e006c9c88620fdc14911dfeb1057ff3bb49ca8",
"tlsh": "1dc2834310f6252849a753e7e56b9351af18ce132b0ab8a0f29d57251f1e88cf1f37e9"
}
],
"package_integrity": [
{
"filename": "agentcli-1.9.32.tgz",
"hashes": {
"sha1": "3b3961d39eebced971f4edd462d30d8ec8f8dc30",
"sha512_sri": "sha512-fycNFjhGxFxgg/sT8sS72nsM0VG5ggqVCnvIdr/ueQQVTThcyX4CZMWF5qyahj7UMsNL0EAOTDni3XEg42WjqQ=="
}
}
]
}
},
"package": {
"ecosystem": "npm",
"name": "@yancyyu/agentcli"
},
"versions": [
"1.9.32",
"1.9.42",
"1.9.35",
"1.9.27",
"1.9.52",
"1.9.43",
"1.9.61",
"1.9.66",
"1.9.67",
"1.9.48",
"1.9.26",
"1.9.77",
"1.9.44",
"1.9.53",
"1.9.29",
"1.9.40",
"1.9.33",
"1.9.36",
"1.9.50",
"1.9.71",
"1.9.58",
"1.9.79",
"1.9.30",
"1.9.78",
"1.9.28",
"1.9.80",
"1.9.25"
]
}
],
"credits": [
{
"contact": [
"inspector-research@amazon.com"
],
"name": "Amazon Inspector",
"type": "FINDER"
}
],
"database_specific": {
"malicious-packages-origins": [
{
"id": "IN-MAL-2026-010879",
"import_time": "2026-07-28T14:19:57.174630207Z",
"modified_time": "2026-07-28T13:30:51Z",
"sha256": "10b67ca39014513878a16bd2459cd4f1e6ebf24934aa5784df51b9acc766f264",
"source": "amazon-inspector",
"versions": [
"1.9.32"
]
},
{
"id": "IN-MAL-2026-014789",
"import_time": "2026-08-05T13:08:46.640961459Z",
"modified_time": "2026-08-05T12:51:30Z",
"sha256": "7a6db15f3c61b8f2b394478af94c4b9f58cdce9f5007012b8e0e5b883f8ccb81",
"source": "amazon-inspector",
"versions": [
"1.9.42"
]
},
{
"id": "IN-MAL-2026-014814",
"import_time": "2026-08-05T13:08:48.527862019Z",
"modified_time": "2026-08-05T12:56:07Z",
"sha256": "88391b25e025074f89b9807478519246f9b12a7ad1929a0a04c4ba12eddf9a07",
"source": "amazon-inspector",
"versions": [
"1.9.35"
]
},
{
"id": "IN-MAL-2026-014800",
"import_time": "2026-08-05T13:08:47.405694498Z",
"modified_time": "2026-08-05T12:53:12Z",
"sha256": "f9b6bcbf02d925d1138d0cedb9d31e8c78792d419bb0f1f165ac721b2a358803",
"source": "amazon-inspector",
"versions": [
"1.9.27"
]
},
{
"id": "IN-MAL-2026-017173",
"import_time": "2026-08-08T00:53:08.565570322Z",
"modified_time": "2026-08-08T00:48:36Z",
"sha256": "56ca7986e94bf6014ed0c7aa7402d3c6db6e8f6de75d630f261465203cfc3cb7",
"source": "amazon-inspector",
"versions": [
"1.9.52"
]
},
{
"id": "IN-MAL-2026-017175",
"import_time": "2026-08-08T00:53:08.711795544Z",
"modified_time": "2026-08-08T00:48:59Z",
"sha256": "56d4294e5480488e46551a40136052a1dd16c42720ea2509835db2d5fafc03a8",
"source": "amazon-inspector",
"versions": [
"1.9.43"
]
},
{
"id": "IN-MAL-2026-017192",
"import_time": "2026-08-08T00:53:09.757446538Z",
"modified_time": "2026-08-08T00:51:24Z",
"sha256": "7babf0cc388e02d1f0b2939f1f68ce7b9714bc28c261932386300a3574d68397",
"source": "amazon-inspector",
"versions": [
"1.9.61"
]
},
{
"id": "IN-MAL-2026-017182",
"import_time": "2026-08-08T00:53:09.127059274Z",
"modified_time": "2026-08-08T00:50:00Z",
"sha256": "9ac7f0e3c2c3e7754640b213b01d06f9ed75d672d64c1011ed6172a5792c21a0",
"source": "amazon-inspector",
"versions": [
"1.9.66"
]
},
{
"id": "IN-MAL-2026-017184",
"import_time": "2026-08-08T00:53:09.251262574Z",
"modified_time": "2026-08-08T00:50:14Z",
"sha256": "9ee1f17b07ed88c1615d1570d311b968675bc579fc43e58fa72bf162f62dadb5",
"source": "amazon-inspector",
"versions": [
"1.9.67"
]
},
{
"id": "IN-MAL-2026-017170",
"import_time": "2026-08-08T00:53:08.374982431Z",
"modified_time": "2026-08-08T00:48:09Z",
"sha256": "aa00d94088265daa445b5484137f5a8e3a642de907475f76618083fc21c562a8",
"source": "amazon-inspector",
"versions": [
"1.9.48"
]
},
{
"id": "IN-MAL-2026-017181",
"import_time": "2026-08-08T00:53:09.068334722Z",
"modified_time": "2026-08-08T00:49:51Z",
"sha256": "b6f47205ab88810800770bb78e0bc408bc9ec3a7a4f25bf941f069241e1052cd",
"source": "amazon-inspector",
"versions": [
"1.9.26"
]
},
{
"id": "IN-MAL-2026-017188",
"import_time": "2026-08-08T00:53:09.493865771Z",
"modified_time": "2026-08-08T00:50:49Z",
"sha256": "195ac70f37e1d413634857ce9b2028b4a6113f355b9b95893ac83db43918e590",
"source": "amazon-inspector",
"versions": [
"1.9.77"
]
},
{
"id": "IN-MAL-2026-017174",
"import_time": "2026-08-08T00:53:08.621447576Z",
"modified_time": "2026-08-08T00:48:49Z",
"sha256": "4901552125568a59097d415d86ce33d8c58e34c310ff88e2c39e622a65a6004a",
"source": "amazon-inspector",
"versions": [
"1.9.44"
]
},
{
"id": "IN-MAL-2026-017171",
"import_time": "2026-08-08T00:53:08.449076803Z",
"modified_time": "2026-08-08T00:48:17Z",
"sha256": "cd05293e460d530740baac9ed76214c8aebae2c1ec3e62a773f6d18201f23457",
"source": "amazon-inspector",
"versions": [
"1.9.53"
]
},
{
"id": "IN-MAL-2026-017180",
"import_time": "2026-08-08T00:53:09.00933501Z",
"modified_time": "2026-08-08T00:49:40Z",
"sha256": "ce8aac20108e18ccadc4f507a2c46d8c68e02e1d4120ed71b7ea34be497de71a",
"source": "amazon-inspector",
"versions": [
"1.9.29"
]
},
{
"id": "IN-MAL-2026-017179",
"import_time": "2026-08-08T00:53:08.950287222Z",
"modified_time": "2026-08-08T00:49:29Z",
"sha256": "e7dddfc8ef5507e863d3f9c5bfb41aa9f33c39576748180ed1f214a0e3b958fd",
"source": "amazon-inspector",
"versions": [
"1.9.40"
]
},
{
"id": "IN-MAL-2026-017176",
"import_time": "2026-08-08T00:53:08.77036806Z",
"modified_time": "2026-08-08T00:49:07Z",
"sha256": "00eaee1d97d1213adb78e4d98f8a0e12b63a14aa047c2067790d0785d7f2dc29",
"source": "amazon-inspector",
"versions": [
"1.9.33"
]
},
{
"id": "IN-MAL-2026-017178",
"import_time": "2026-08-08T00:53:08.888498598Z",
"modified_time": "2026-08-08T00:49:22Z",
"sha256": "96b9b67b6242662bc6764cc0477e0e068d57ca310d816c5f91fd76e2f61ec91b",
"source": "amazon-inspector",
"versions": [
"1.9.36"
]
},
{
"id": "IN-MAL-2026-017172",
"import_time": "2026-08-08T00:53:08.509226165Z",
"modified_time": "2026-08-08T00:48:26Z",
"sha256": "bfddf2f96157ec5e79aef8c1a3f8bee90cb95a160ec4ae5cec019f0a63429cab",
"source": "amazon-inspector",
"versions": [
"1.9.50"
]
},
{
"id": "IN-MAL-2026-017185",
"import_time": "2026-08-08T00:53:09.309117517Z",
"modified_time": "2026-08-08T00:50:25Z",
"sha256": "1a53d10f01aa0ae30707b0c4f940082ff6aa4ae8eb7d7261f8ce2be9a6236171",
"source": "amazon-inspector",
"versions": [
"1.9.71"
]
},
{
"id": "IN-MAL-2026-017186",
"import_time": "2026-08-08T00:53:09.370468069Z",
"modified_time": "2026-08-08T00:50:32Z",
"sha256": "4b01add999e692277fe94d2e278051d1532c12ff73b569aea7013bd755ec1d7f",
"source": "amazon-inspector",
"versions": [
"1.9.58"
]
},
{
"id": "IN-MAL-2026-017191",
"import_time": "2026-08-08T00:53:09.696399081Z",
"modified_time": "2026-08-08T00:51:17Z",
"sha256": "7f6774653f487db8fbb9b40f1c1aba2bf959edffae409445162b0d245a3bedf1",
"source": "amazon-inspector",
"versions": [
"1.9.79"
]
},
{
"id": "IN-MAL-2026-017177",
"import_time": "2026-08-08T00:53:08.826506434Z",
"modified_time": "2026-08-08T00:49:14Z",
"sha256": "87e50624a116710c2841131b9d46d28093c452498a2b58b4330e62a316e33fb4",
"source": "amazon-inspector",
"versions": [
"1.9.30"
]
},
{
"id": "IN-MAL-2026-017189",
"import_time": "2026-08-08T00:53:09.550911603Z",
"modified_time": "2026-08-08T00:50:58Z",
"sha256": "bfdc68ab10663e643ad339057a1e386c46e422f8eaa550cea595d068050dfbeb",
"source": "amazon-inspector",
"versions": [
"1.9.78"
]
},
{
"id": "IN-MAL-2026-017183",
"import_time": "2026-08-08T00:53:09.189059244Z",
"modified_time": "2026-08-08T00:50:08Z",
"sha256": "d39f9ac9ca12736eaae21f8ec2a8a5b845ecdea82ef356b80521d1df95677d9a",
"source": "amazon-inspector",
"versions": [
"1.9.28"
]
},
{
"id": "IN-MAL-2026-017187",
"import_time": "2026-08-08T00:53:09.430668235Z",
"modified_time": "2026-08-08T00:50:42Z",
"sha256": "efc4879d1133923b0f8cf97b5ee308ebc086f8379dff6196a0a2211bb958e248",
"source": "amazon-inspector",
"versions": [
"1.9.80"
]
},
{
"id": "IN-MAL-2026-017190",
"import_time": "2026-08-08T00:53:09.635296573Z",
"modified_time": "2026-08-08T00:51:08Z",
"sha256": "fba4521811f608f2adaa7cb5d4b68681ccd1cfc196c0da20db38127b98a2dc25",
"source": "amazon-inspector",
"versions": [
"1.9.25"
]
}
]
},
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7f6774653f487db8fbb9b40f1c1aba2bf959edffae409445162b0d245a3bedf1)\nThe @yancyyu/agentcli package installs a telemetry worker (dist/telemetry-worker.bundle.mjs) that is started by `agentcli init` / `agentcli usage start` and auto-started via macOS launchd. The worker enumerates every lark-cli (Feishu) profile stored on the host \u2014 decrypting macOS Keychain-wrapped AES-256-GCM `.enc` files under `~/Library/Application Support/lark-cli/` and Windows DPAPI-protected values under `HKCU\\Software\\LarkCli\\keychain` \u2014 refreshes each token, and batch-POSTs `{app_id, app_secret, access_token, refresh_token}` for every profile every 5 minutes to a hardcoded default endpoint `http://47.112.24.153` (plain HTTP, bare IPv4, no TLS). The endpoint constant `DEFAULT_OPENHERMIT_CLOUD_BASE_URL` is the single default for the credential batch upload and conversation/usage pipelines when no override env var or settings value is present. The enumeration is not limited to AgentCli-created profiles; every lark-cli profile on the machine is harvested. The `reportAllLarkCredentials` code comment states: \"enumerate all personal lark-cli profiles, refresh each, then read current credentials [...] batch the complete eligible set to the server.\" The postinstall step additionally rewrites the optional `cc-connect` dependency\u0027s installer to prepend third-party China GitHub mirror hosts (gh-proxy.com, ghproxy.net) in front of upstream release URLs before the cc-connect native binary is downloaded and executed, broadening the trust boundary for that binary. Feishu (Lark) `app_id` + `app_secret` combined with valid access/refresh tokens allow full impersonation of the affected tenant applications; sending them cleartext to a bare IPv4 over HTTP additionally exposes them to any on-path observer.\n",
"id": "MAL-2026-11123",
"modified": "2026-08-08T00:55:05.740560013Z",
"published": "2026-07-28T13:30:51Z",
"references": [
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.32"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.42"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.35"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.27"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.52"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.43"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.61"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.66"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.67"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.48"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.26"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.77"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.44"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.53"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.29"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.40"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.33"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.36"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.50"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.71"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.58"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.79"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.30"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.78"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.28"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.80"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@yancyyu/agentcli/v/1.9.25"
}
],
"schema_version": "1.7.4",
"summary": "Malicious code in @yancyyu/agentcli (npm)"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…