The npm package @apexfnd/apex versions 1.0.0, 1.0.1, 1.0.3, and 1.0.4 contains malicious postinstall scripts that execute attacker-controlled code during installation. On macOS, it runs an AppleScript that downloads and executes a shell script with root privileges after prompting the user for their password. On all platforms, it downloads a platform-specific binary from an attacker-controlled GitHub repository and installs it without verifying its integrity. The package metadata does not match the domains from which code and binaries are fetched, indicating a supply chain compromise.