New Threats Include macOS Infostealer via npm Package and Malicious VS Code Extension

macOS Infostealer Distributed via npm

An npm package named @copilot-mcp/apex has been identified as a postinstall dropper that deploys a macOS infostealer. When a user runs 'npm install' or 'npx @copilot-mcp/apex', the malware is installed. The same payload has also been distributed through another dropper, @apexfdn/apex.

Infostealer Capabilities

On macOS, the dropper's second stage decrypts and executes an AppleScript payload. This AMOS-family stealer phishes login passwords, harvests browser credentials, over 20 crypto wallets, SSH keys, AWS and Kubernetes credentials, login Keychain data, Telegram information, and shell history. The collected data is compressed into /tmp/osalogging.zip and uploaded to attacker infrastructure. The malware also establishes a LaunchAgent to maintain persistence by polling a command-and-control server every 60 seconds.

Malicious VS Code Extension

A Microsoft Visual Studio Code (VS Code) marketplace extension, "Markdown All Pro" (markdown.markdown-all-pro), has been found impersonating the legitimate "Markdown All in One" extension, which has over 14 million downloads. Installing the rogue extension allows the exfiltration of machine details to attackers and creates a channel for further commands.

GitHub Enterprise Server Security Update

GitHub announced a security change affecting GitHub Enterprise Server (GHES) support bundle uploads. Starting August 18, 2026, GitHub will reject command-line support bundle uploads from older GHES appliances that lack required security patches. To avoid disruption, GHES instances must be updated to the latest patch release for their current version line. Minimum required patch versions include 3.21.3, 3.20.5, 3.19.9, 3.18.12, and 3.17.18.