MAL-2026-16032 Malicious code in feishu-docx-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e7567437816acf6d56f5ef9e5303da39aa1663ac47d547f66552a0482158d19 package.json declares "preinstall": "bun run index.js" and lists bun as a runtime dependency, so npm install fetches the alternate Bun runtime and...

Malicious code in feishu-docx-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e7567437816acf6d56f5ef9e5303da39aa1663ac47d547f66552a0482158d19 package.json declares "preinstall": "bun run index.js" and lists bun as a runtime dependency, so npm install fetches the alternate Bun runtime and...

CVE-2026-85621

LobeChat LobeHub 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route /api/agent/webhooks/:platform is unauthenticated by design and delegates verification to each adapter; the QQ adapter performs no Ed25519 signature verificatio...

CVE-2026-85621 LobeChat 2.2.1 Webhook Signature Verification Bypass QQ Feishu

LobeChat LobeHub 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route /api/agent/webhooks/:platform is unauthenticated by design and delegates verification to each adapter; the QQ adapter performs no Ed25519 signature verificatio...

EUVD-2026-71228

LobeChat LobeHub 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route /api/agent/webhooks/:platform is unauthenticated by design and delegates verification to each adapter; the QQ adapter performs no Ed25519 signature verificatio...

CVE-2026-85621

LobeChat (LobeHub) 2.2.1 has an improper webhook signature verification flaw in its QQ and Feishu adapters . The webhook route (/api/agent/webhooks/:platform) is unauthenticated by design and delegates verification to each adapter. The QQ adapter performs no Ed25519 signature verification on disp...

CVE-2026-85621 LobeChat 2.2.1 Webhook Signature Verification Bypass QQ Feishu

LobeChat LobeHub 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route /api/agent/webhooks/:platform is unauthenticated by design and delegates verification to each adapter; the QQ adapter performs no Ed25519 signature verificatio...

MAL-2026-11123 Malicious code in @yancyyu/agentcli (npm)

The npm package @yancyyu/agentcli ships a Feishu/Lark credential stealer. An auto-started telemetry worker src/main/telemetry/worker.ts, started via agentcli init/agentcli usage start and macOS launchd calls safeScanLarkCredentials in its periodic run loop; the scan reads and decrypts local Lark...

EUVD-2026-45408

A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. The affected element is the function handleMessageReceive of the file pkg/channels/feishu/feishu64.go of the component Group Message Handler. Such manipulation leads to missing authorization. The attack can be launched...

CVE-2026-16197 Sipeed PicoClaw Group Message feishu_64.go handleMessageReceive authorization

A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. The affected element is the function handleMessageReceive of the file pkg/channels/feishu/feishu64.go of the component Group Message Handler. Such manipulation leads to missing authorization. The attack can be launched...

Incorrect Authorization

Overview @openclaw/feishu is an OpenClaw Feishu/Lark channel plugin community maintained by @m1heng Affected versions of this package are vulnerable to Incorrect Authorization in the feishu process. An attacker can perform unauthorized operations by exploiting insufficient authorization checks on...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the feishu process. An attacker can perform unauthorized operations by exploiting insufficient authorization checks on certain actions, allowing lower-trust...

Incorrect Authorization

Overview @openclaw/feishu is an OpenClaw Feishu/Lark channel plugin community maintained by @m1heng Affected versions of this package are vulnerable to Incorrect Authorization due to the Feishu permission tools process. An attacker can gain unauthorized access to perform privileged actions by...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization due to the Feishu permission tools process. An attacker can gain unauthorized access to perform privileged actions by exploiting the lack of proper authorization...

EUVD-2026-43566

OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account disablement settings. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could...

EUVD-2026-43565

OpenClaw Feishu tools npm package @openclaw/feishu in versions = 2026.6.6 could ignore per-account disablement. A lower-trust caller or a configured input path could perform actions that should have required a stronger authorization or policy check, resulting in unauthorized operations. The issue...

CVE-2026-62187

OpenClaw Feishu tools npm package @openclaw/feishu in versions = 2026.6.6 could ignore per-account disablement. A lower-trust caller or a configured input path could perform actions that should have required a stronger authorization or policy check, resulting in unauthorized operations. The issue...

CVE-2026-62188

OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account disablement settings. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could...

CVE-2026-62188 OpenClaw < 2026.6.9 Feishu Authorization Bypass

OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account disablement settings. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could...

CVE-2026-62188

OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account disablement settings. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could...