18:05
2026-07-22
safedep.io
ai-tools
@copilot-mcp/apex: A macOS Infostealer Re-Published on npm After Takedown
The npm package @copilot-mcp/apex is a postinstall dropper that installs a macOS infostealer on any machine that runs npm install or npx @copilot-mcp/apex, according to a security analysis. The packag…