Malicious code in apex-connector (npm)
The npm package apex-connector version 1.0.4 was identified as malicious by both Amazon Inspector and the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed apex-connector version 1.0.4
- Ecosystems
- Attack vectors
- Affected entities
- apex-connector · 1.0.4
The npm package apex-connector version 1.0.4 was flagged as malicious by multiple security sources. Amazon Inspector and the OpenSSF Package Analysis project independently identified the package as containing malicious code.
According to the OpenSSF Package Analysis findings, the package executes one or more commands associated with malicious behavior. The malicious package was documented in the OpenSSF malicious-packages repository with identifier MAL-2026-3816.
The package has been identified and reported through GitHub's advisory system (GHSA-h523-58g3-c5vg), allowing the npm ecosystem to take action against the malicious distribution.
Indicators of compromise
- Packages
- apex-connector@1.0.4
Remediation
- Remove apex-connector version 1.0.4 from all projects immediately
- Audit project dependencies to identify any installations of apex-connector 1.0.4
- Review and rotate any credentials or secrets that may have been exposed on systems where the malicious package was installed
- Monitor affected systems for signs of compromise or unauthorized command execution
- Update to a safe version of apex-connector if a legitimate version exists, or replace with an alternative package
Sources
- GitHub Advisory GHSA-h523-58g3-c5vg · GitHub Advisory Database
Cite this entry
"Malicious code in apex-connector (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-apex-connector-npm-1tcscv
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in edu-npm-dependency-chain-demo
Malware discovered in the npm package edu-npm-dependency-chain-demo. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in roblox-api-client
Malware was discovered in the npm package roblox-api-client, resulting in full system compromise for any computer with the package installed or running. The advisory recommends immediate removal of the package and rotation of all secrets and keys from a different computer.
npmCompromised package - containedcritical
Malware in jextic-eclib
Malware was discovered in the npm package jextic-eclib, resulting in full system compromise of any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - activecritical
Malware in @thone33/analytics-injector
Malware discovered in the npm package @thone33/analytics-injector. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package