Skip to main content
MalwarePublished

@copilot-mcp/apex (npm) · Malicious Code

Affects @copilot-mcp/apexSource GCVE Database

0

Malicious package : remove @copilot-mcp/apex and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 15:43 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12314

What to do

Remove @copilot-mcp/apex from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

ProductAffectedFixed in
npm@copilot-mcp/apexAffected
  • 1.0.0 – 1.0.22
13 affected builds		Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @copilot-mcp/apex contains malicious code that executes during installation. It runs a postinstall script that performs remote code execution by downloading and executing attacker-controlled scripts and binaries. On macOS, it additionally prompts for admin credentials via a native authentication dialog, enabling privilege escalation through social engineering. The package impersonates a legitimate project and ships no actual source code except the malicious installer and loader scripts.

References

Community reviews

Loading reviews…