The npm package @apexfnd/apex includes a postinstall script (install.cjs) that performs two malicious actions at install time. On macOS, it writes an AppleScript to /tmp and uses osascript to run a remote shell script from update.apex-arena-router.com with administrator privileges, prompting the user for their password and executing the script as root. On all platforms, it downloads a platform-specific binary from a GitHub repository (github.com/Apex-Foundation/copilot), writes it to the package's bin path, and sets executable permissions without any hash or signature verification. The declared publisher metadata (homepage omp.sh, repository can1357/oh-my-pi) does not correspond to the domains hosting the malicious content, confirming that the fetched content is attacker-controlled and executed with elevated privileges on macOS.

This malicious package enables remote code execution during installation, including execution with root privileges on macOS if the user provides their password. The attacker-controlled scripts and binaries can compromise the installer's machine, potentially leading to full system compromise. The lack of integrity verification for downloaded binaries increases the risk of arbitrary code execution.

No official patch or remediation is currently documented. Users and organizations should avoid installing or using the @apexfnd/apex package versions 1.0.0, 1.0.1, 1.0.3, and 1.0.4. Verify package authenticity before installation and prefer packages from trusted sources. Monitor for updates or advisories from the package maintainers or npm registry regarding this issue. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.