@apexacc/cli@1.5.74: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@apexacc/cli@1.5.74: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

apex.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @apexacc/cli@1.5.69 matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.5.69 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

apex.cjsView on unpkg

1#!/usr/bin/env node L2: const { spawnSync } = require('child_process') L3: const { join } = require('path')

High

Child Process

Package source references child process execution.

apex.cjsView on unpkg · L1

1#!/usr/bin/env node L2: const { spawnSync } = require('child_process') L3: const { join } = require('path') L4: const { existsSync, mkdirSync, createWriteStream } = require('fs') L5: const https = require('https') L6: const os = require('os') ... L12: const result = spawnSync(process.execPath, [mcpBin, ...process.argv.slice(3)], { L13: stdio: 'inherit', env: process.env L14: })

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

apex.cjsView on unpkg · L1

16} catch { L17: const result = spawnSync('npx', ['-y', '@apexfdn/copilot-mcp@0.11.6'], { L18: stdio: 'inherit', env: process.env

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

apex.cjsView on unpkg · L16

54async function ensureBinary() { if (existsSync(BIN_PATH)) return console.log('Downloading Apex Copilot (~114MB), please wait...') const target = getPlatformTarget() const assetName = isWin ? `apex-${target}.exe` : `apex-${target}` const url = `https://github.com/${REPO}/releases/download/v${VERSION}/${assetName}` mkdirSync(BIN_DIR, { recursive: true }) await download(url, BIN_PATH) const { chmodSync } = require('fs') if (!isWin) chmodSync(BIN_PATH, 0o755)

Medium

Ai Review Evidence

The user-invoked CLI downloads opaque platform binaries from GitHub and immediately executes them.

apex.cjsView on unpkg · L54

111ensureBinary().then(() => { const result = spawnSync(BIN_PATH, process.argv.slice(2), { stdio: 'inherit', env: process.env }) process.exit(result.status ?? 0)

Medium

Ai Review Evidence

The user-invoked CLI downloads opaque platform binaries from GitHub and immediately executes them.

apex.cjsView on unpkg · L111

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

Source & flagged code

7 flagged

apex.cjsView file

Lines 1-74javascript

1#!/usr/bin/env node

2const { spawnSync } = require('child_process')

3const { join } = require('path')

High

Child Process

Package source references child process execution.

apex.cjsView on unpkg · L1

4const { existsSync, mkdirSync, createWriteStream } = require('fs')

5const https = require('https')

6const os = require('os')

7

8// MCP stdio mode

9if (process.argv.includes('--mcp-stdio')) {

10 try {

11 const mcpBin = require.resolve('@apexfdn/copilot-mcp/bin/copilot-mcp.js')

12 const result = spawnSync(process.execPath, [mcpBin, ...process.argv.slice(3)], {

13 stdio: 'inherit', env: process.env

14 })

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

apex.cjsView on unpkg · L1

15 process.exit(result.status ?? 0)

16 } catch {

17 const result = spawnSync('npx', ['-y', '@apexfdn/copilot-mcp@0.11.6'], {

18 stdio: 'inherit', env: process.env

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

apex.cjsView on unpkg · L16

19 })

20 process.exit(result.status ?? 0)

21 }

22}

23

24const REPO = 'Apex-Accelerator/apexcli'

25const VERSION = require('./package.json').releaseVersion || require('./package.json').version

26const isWin = process.platform === 'win32'

27const BIN_DIR = join(os.homedir(), '.apex', 'bin')

28const BIN_PATH = join(BIN_DIR, isWin ? 'apex.exe' : 'apex')

29

30function getPlatformTarget() {

31 const p = process.platform, a = process.arch

32 if (p === 'linux' && a === 'x64') return 'linux-x64'

33 if (p === 'darwin' && a === 'arm64') return 'darwin-arm64'

34 if (p === 'darwin' && a === 'x64') return 'darwin-x64'

35 if (p === 'win32' && a === 'x64') return 'windows-x64'

36 throw new Error(`Unsupported: ${p}-${a}`)

37}

38

39function download(url, dest) {

40 return new Promise((resolve, reject) => {

41 const file = createWriteStream(dest)

42 const req = (u) => {

43 https.get(u, { headers: { 'User-Agent': 'apex-installer' } }, (res) => {

44 if (res.statusCode === 301 || res.statusCode === 302) { req(res.headers.location); return }

45 if (res.statusCode !== 200) { reject(new Error(`HTTP ${res.statusCode}`)); return }

46 res.pipe(file)

47 file.on('finish', () => { file.close(); resolve() })

48 }).on('error', reject)

49 }

50 req(url)

51 })

52}

53

54async function ensureBinary() {

55 if (existsSync(BIN_PATH)) return

56

57 console.log('Downloading Apex Copilot (~114MB), please wait...')

58 const target = getPlatformTarget()

59 const assetName = isWin ? `apex-${target}.exe` : `apex-${target}`

60 const url = `https://github.com/${REPO}/releases/download/v${VERSION}/${assetName}`

61

62 mkdirSync(BIN_DIR, { recursive: true })

63 await download(url, BIN_PATH)

64

65 const { chmodSync } = require('fs')

Medium

Ai Review Evidence

The user-invoked CLI downloads opaque platform binaries from GitHub and immediately executes them.

apex.cjsView on unpkg · L54

66 if (!isWin) chmodSync(BIN_PATH, 0o755)

67

68 // Windows: download native addon

69 if (isWin) {

70 const nativesDir = join(os.homedir(), '.apex', 'natives', '16.3.6')

71 const nodeFile = 'pi_natives.win32-x64-baseline.node'

72 const nodePath = join(nativesDir, nodeFile)

73 if (!existsSync(nodePath)) {

74 console.log('Downloading native addon...')

Lines 91-120javascript

91 if (needsUpdate) {

92 mkdirSync(join(os.homedir(), '.apex'), { recursive: true })

93 await download(`https://github.com/${REPO}/releases/download/v${VERSION}/apex-verify-windows.exe`, verifyPath)

94 require(

•matchType = previous_version_dangerous_delta matchedPackage = @apexacc/cli@1.5.69 matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.5.69 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

apex.cjsView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg