GCVE-110-OSM-2026-8908

The install.cjs script follows a well-known legitimate pattern — downloading a platform-specific binary from GitHub releases on postinstall — consistent with tools like esbuild or puppeteer. The use of process.platform is purely for binary selection, not exfiltration; the IOC classifier mislabeled the download URL as 'exfil.' The 'chalk is malicious' dependency finding is almost certainly a false positive — chalk is one of the most widely used npm packages in the ecosystem. The primary residual risk is that the downloaded pre-built binaries (apex-linux-x64, apex-darwin-arm64, etc.) cannot be audited from this evidence alone, and the tool self-describes as a coding agent with bash execution capability backed by external services (hindsight.vectorize.io, omp.sh) whose behavior is opaque without examining apex.cjs more deeply. ENTRY install.cjs (install-hook: node install.cjs) - Install Hook Executes Local JS File in package.json DESTINATION - reconstructed: https://github.com/Apex-Foundation/copilot/releases/download/v1.0.0/pi_natives.win32-x64-baseline.node (primary, reconstructed) in install.cjs - domains: github.com (c2, plaintext) EXFIL - System Information Collection in apex.cjs: "process.platform" - Network Request in install.cjs: "https.get(" - System Information Collection in install.cjs: "process.platform" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in install.cjs: "https://github.com/Apex-Foundation/copilot/releases/download/v1.0.0/pi_natives.w..." - Shell Command Execution in apex.cjs: "require('child_process')" - Malicious Dependency Detected in package.json PAYLOAD FILES install.cjs (+ apex.cjs) INDICATORS (IOCs) - urls: https://hindsight.vectorize.io, https://omp.sh - domains: hindsight.vectorize.io, omp.sh - payloadFileHash: b00c92579c39ae99a6f9dca3e26305e6be8ef14e31fc2d009ab7200896626420