@apexacc/cli@1.5.94: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@apexacc/cli@1.5.94: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

apex.cjsView file

1#!/usr/bin/env node L2: const { spawnSync } = require('child_process') L3: const { join } = require('path')

High

Child Process

Package source references child process execution.

apex.cjsView on unpkg · L1

90mkdirSync(join(os.homedir(), '.apex'), { recursive: true }) L91: await download(`https://github.com/${REPO}/releases/download/v${VERSION}/apex-verify-darwin`, verifyPath) L92: require('fs').chmodSync(verifyPath, 0o755) ... L99: ensureBinary().then(() => { L100: const result = spawnSync(BIN_PATH, process.argv.slice(2), { L101: stdio: 'inherit', env: process.env L102: })

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

apex.cjsView on unpkg · L90

1#!/usr/bin/env node L2: const { spawnSync } = require('child_process') L3: const { join } = require('path') L4: const { existsSync, mkdirSync, createWriteStream } = require('fs') L5: const https = require('https') L6: const os = require('os') ... L8: const REPO = 'Apex-Accelerator/apexcli' L9: const VERSION = require('./package.json').releaseVersion || require('./package.json').version L10: const isWin = process.platform === 'win32' L11: const BIN_DIR = join(os.homedir(), '.apex', 'bin') L12: const BIN_PATH = join(BIN_DIR, isWin ? 'apex.exe' : 'apex') ... L100: const result = spawnSync(BIN_PATH, process.argv.slice(2), {

High

Remote System File Write

Source writes bytes from a remote response into a privileged operating-system path.

apex.cjsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = @apexacc/cli@1.5.109 matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.5.109 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

apex.cjsView on unpkg

48const url = `https://github.com/${REPO}/releases/download/v${VERSION}/${assetName}` mkdirSync(BIN_DIR, { recursive: true }) await download(url, BIN_PATH) const { chmodSync } = require('fs') if (!isWin) chmodSync(BIN_PATH, 0o755)

Medium

Ai Review Evidence

The CLI downloads a versioned executable from GitHub and writes it to the user's home directory.

apex.cjsView on unpkg · L48

30const req = (u) => { https.get(u, { headers: { 'User-Agent': 'apex-installer' } }, (res) => { if (res.statusCode === 301 || res.statusCode === 302) { req(res.headers.location); return } if (res.statusCode !== 200) { cleanup(new Error(`HTTP ${res.statusCode}`)); return } res.pipe(file) file.on('finish', () => { file.close(); resolve() }) }).on('error', cleanup) } req(url)

Medium

Ai Review Evidence

It follows redirects without validating the destination or verifying a checksum/signature, then marks the downloaded file executable and runs it with the caller's environment.

apex.cjsView on unpkg · L30

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

Source & flagged code

7 flagged

apex.cjsView file

Lines 1-108javascript

1#!/usr/bin/env node

2const { spawnSync } = require('child_process')

3const { join } = require('path')

High

Child Process

Package source references child process execution.

apex.cjsView on unpkg · L1

4const { existsSync, mkdirSync, createWriteStream } = require('fs')

5const https = require('https')

6const os = require('os')

7

8const REPO = 'Apex-Accelerator/apexcli'

9const VERSION = require('./package.json').releaseVersion || require('./package.json').version

10const isWin = process.platform === 'win32'

11const BIN_DIR = join(os.homedir(), '.apex', 'bin')

12const BIN_PATH = join(BIN_DIR, isWin ? 'apex.exe' : 'apex')

13

14function getPlatformTarget() {

15 const p = process.platform, a = process.arch

16 if (p === 'darwin' && a === 'arm64') return 'darwin-arm64'

17 if (p === 'darwin' && a === 'x64') return 'darwin-x64'

18 if (p === 'win32' && a === 'x64') return 'windows-x64'

19 throw new Error(`Unsupported platform: ${p}-${a}. Currently supported: macOS (arm64, x64), Windows (x64).`)

20}

21

22function download(url, dest) {

23 return new Promise((resolve, reject) => {

24 const file = createWriteStream(dest)

25 const cleanup = (err) => {

26 file.close()

27 try { require('fs').unlinkSync(dest) } catch {}

28 reject(err)

29 }

30 const req = (u) => {

31 https.get(u, { headers: { 'User-Agent': 'apex-installer' } }, (res) => {

32 if (res.statusCode === 301 || res.statusCode === 302) { req(res.headers.location); return }

33 if (res.statusCode !== 200) { cleanup(new Error(`HTTP ${res.statusCode}`)); return }

34 res.pipe(file)

35 file.on('finish', () => { file.close(); resolve() })

36 }).on('error', cleanup)

37 }

38 req(url)

Medium

Ai Review Evidence

It follows redirects without validating the destination or verifying a checksum/signature, then marks the downloaded file executable and runs it with the caller's environment.

apex.cjsView on unpkg · L30

39 })

40}

41

42async function ensureBinary() {

43 if (existsSync(BIN_PATH)) return

44

45 console.log('Downloading Apex Copilot (~114MB), please wait...')

46 const target = getPlatformTarget()

47 const assetName = isWin ? `apex-${target}.exe` : `apex-${target}`

48 const url = `https://github.com/${REPO}/releases/download/v${VERSION}/${assetName}`

49

50 mkdirSync(BIN_DIR, { recursive: true })

51 await download(url, BIN_PATH)

52

53 const { chmodSync } = require('fs')

54 if (!isWin) chmodSync(BIN_PATH, 0o755)

Medium

Ai Review Evidence

The CLI downloads a versioned executable from GitHub and writes it to the user's home directory.

apex.cjsView on unpkg · L48

55

56 // Windows: download native addon

57 if (isWin) {

58 const nativesDir = join(os.homedir(), '.apex', 'natives', '16.3.6')

59 const nodeFile = 'pi_natives.win32-x64-baseline.node'

60 const nodePath = join(nativesDir, nodeFile)

61 if (!existsSync(nodePath)) {

62 console.log('Downloading native addon...')

63 mkdirSync(nativesDir, { recursive: true })

64 await download(`https://github.com/${REPO}/releases/download/v${VERSION}/${nodeFile}`, nodePath)

65 }

66 }

67

68 // Win: download apex-verify

70 const verifyPath = join(os.homedir(), '.apex', 'apex-verify.exe')

71 const verifyVersionPath = join(os.homedir(), '.apex', '.verify-version-win')

72 let needsUpdate = !existsSync(verifyPath)

73 if (!needsUpdate) {

74 try {

75 const saved = require('fs').readFileSync(verifyVersionPath, 'utf8').trim()

76 if (saved !== VERSION) needsUpdate = true

77 } catch { needsUpdate = true }

78 }

79 if (needsUpdate) {

80 mkdirSync(join(os.homedir(), '.apex'), { recursive: true })

81 await download(`https://github.com/${REPO}/releases/download/v${VERSION}/apex-verify-windows.exe`, verifyPath)

82 require('fs').writeFileSync(verifyVersionPath, VERSION)

83 }

84 }

85

86 // Mac: download apex-verify

87 if (process.platform === 'darwin') {

88 const verifyPath = join(os.homedir(), '.apex', 'apex-verify')

89 if (!existsSync(verifyPath)) {

90 mkdirSync(join(os.homedir(), '.apex'), { recursive: true })

91 await download(`https://github.com/${REPO}/releases/download/v${VERSION}/apex-verify-darwin`, verifyPath)

92 require('fs').chmodSync(verifyPath, 0o755)

93 }

94 }

95

96 console.log('Done!')

97}

98

99ensureBinary().then(() => {

100 const result = spawnSync(BIN_PATH, process.argv.slice(2), {

High

Remote System File Write

Source writes bytes from a remote response into a privileged operating-system path.

apex.cjsView on unpkg · L1

101 stdio: 'inherit', env: process.env

102 })

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

apex.cjsView on unpkg · L90

103 process.exit(result.status ?? 0)

104}).catch(err => {

105 console.error('Failed to download Apex:', err.message)

106 process.exit(1)

107})

108

•matchType = previous_version_dangerous_delta matchedPackage = @apexacc/cli@1.5.109 matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.5.109 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

apex.cjsView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg