MAL-2026-11123 Malicious code in @yancyyu/agentcli (npm)

The npm package @yancyyu/agentcli ships a Feishu/Lark credential stealer. An auto-started telemetry worker src/main/telemetry/worker.ts, started via agentcli init/agentcli usage start and macOS launchd calls safeScanLarkCredentials in its periodic run loop; the scan reads and decrypts local Lark...

Malicious code in mcp-server-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34dfb6dc382073bace8a4d413b28000ff42770d04b9f69a88906230e2d83260a Package squats the unscoped name mcp-server-fetch an MCP server name commonly invoked via npx mcp-server-fetch by AI coding agents and developer...

Malicious code in faest (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f66b290465d72fc55bce4fef4200ebea68c430be84cdcbbabec5263958041781 When using this library to do any request, a "validateorigin" function is called L1320 in client.py. This method, located in utils.py, collects all request dat...