MCPA-2026-0095
@copilot-mcp/apex (npm) postinstall dropper pipes an attacker-controlled remote script into zsh and stages an unverified binary
@copilot-mcp/apex impersonates the @copilot-mcp scope with metadata copied verbatim from the unrelated @oh-my-pi/pi-coding-agent project. Its install.cjs runs on npm postinstall and (1) on macOS spawns osascript with a native admin authentication dialog, then pipes https://update.apex-arena-router.com/loader.sh — a mutable attacker-controlled URL unrelated to the declared publisher — into zsh, and (2) downloads an OS-specific 'apex' binary from an unrelated GitHub org's releases, chmods it 0o755, and stages it for execution with no hash or signature verification. The tarball ships no src/ despite package.json declaring ~150 export subpaths; the only code is the dropper and the binary invoker. Installing any published version (1.0.0–1.0.22) yields remote code execution and, on macOS, a social-engineered admin-privilege prompt. The package has been removed from the npm registry; installs made while it was live remain compromised. Flagged as malware by OSV (MAL-2026-12314, amazon-inspector source).
Affected packages
| Ecosystem | Package | Affected versions |
|---|---|---|
| npm | @copilot-mcp/apex | >= 0 |
Identifiers
MAL-2026-12314CWE-506CWE-829
References
- advisory https://osv.dev/vulnerability/MAL-2026-12314
- web https://www.npmjs.com/package/@copilot-mcp/apex
Timeline
- Published: 2026-08-05