Malicious code in apex-connector (npm)
The npm package apex-connector version 1.0.4 was identified as malicious by both Amazon Inspector and the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed apex-connector version 1.0.4
- Ecosystems
- Attack vectors
- Affected entities
- apex-connector · 1.0.4
The npm package apex-connector version 1.0.4 was flagged as malicious by multiple security sources. Amazon Inspector and the OpenSSF Package Analysis project independently identified the package as containing malicious code.
According to the OpenSSF Package Analysis findings, the package executes one or more commands associated with malicious behavior. The malicious package was documented in the OpenSSF malicious-packages repository with identifier MAL-2026-3816.
The package has been identified and reported through GitHub's advisory system (GHSA-h523-58g3-c5vg), allowing the npm ecosystem to take action against the malicious distribution.
Indicators of compromise
- Packages
- apex-connector@1.0.4
Remediation
- Remove apex-connector version 1.0.4 from all projects immediately
- Audit project dependencies to identify any installations of apex-connector 1.0.4
- Review and rotate any credentials or secrets that may have been exposed on systems where the malicious package was installed
- Monitor affected systems for signs of compromise or unauthorized command execution
- Update to a safe version of apex-connector if a legitimate version exists, or replace with an alternative package
Sources
- GitHub Advisory GHSA-h523-58g3-c5vg · GitHub Advisory Database
Cite this entry
"Malicious code in apex-connector (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-apex-connector-npm-1tcscv
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in sme-rko-finance-front-operations-feed-models (npm)
The npm package sme-rko-finance-front-operations-feed-models contained malicious code that downloads and executes attacker-controlled native binaries from remote servers upon package load. The malware uses obfuscation techniques including fragmented string arrays, platform-specific endpoints, and DNS TXT record fallbacks to evade detection.
npmCompromised package - resolvedcritical
Malicious code in modern-localization (npm)
The npm package modern-localization contained malicious code that fetches and executes arbitrary JavaScript from a remote jsonbin.io endpoint on server-side require, with no integrity verification. The payload is executed with full Node.js privileges via Function() or child_process.fork().
npmCompromised package - resolvedcritical
Malicious code in sme-rko-finance-front-operations-tax (npm)
The npm package sme-rko-finance-front-operations-tax contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure on require. The package was identified and reported by OpenSSF's malicious-packages project.
npmCompromised package - resolvedcritical
Malicious code in localization-fixer (npm)
The npm package localization-fixer contained malicious code that fetches and executes arbitrary JavaScript from attacker-controlled jsonbin.io endpoints on package require, granting full Node.js capabilities to remote payloads.
npmCompromised package