The npm package @copilot-mcp/apex contains malicious code that executes during installation. It runs a postinstall script that performs remote code execution by downloading and executing attacker-controlled scripts and binaries. On macOS, it additionally prompts for admin credentials via a native authentication dialog, enabling privilege escalation through social engineering. The package impersonates a legitimate project and ships no actual source code except the malicious installer and loader scripts.