@apexacc/cli npm package is malware — full machine compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's malware advisory database has flagged the npm package @apexacc/cli as embedded malicious code (CWE-506). Every published version (= 0) is affected and no patched version exists — the package itself is the attack. GitHub warns that any computer where the package is installed or running should be considered fully compromised, with the attacker potentially holding full remote control. The package shows ~9,090 downloads per month and 17 GitHub stars, so real-world exposure is plausible. Removal of the package does not guarantee removal of any malicious software it deployed. No CVE is assigned; the advisory was published and reviewed on 2026-11-10.
What to do
- Treat any machine with @apexacc/cli installed as fully compromised; isolate and forensically review it
- Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer
- Remove the package from all projects, lockfiles and CI pipelines; block it in dependency policy
- Rebuild affected systems from trusted images where compromise is suspected
- Audit npm dependencies for other suspicious packages before reinstalling
Sources
All live incidents on Threat Watch
