This Week in Cyber Threats: NPM Stealer, VS Code Backdoor & AI Prompt Injection

A wave of supply chain attacks dominated this week's threat landscape, with malicious packages and counterfeit developer tools targeting developers across platforms. An npm package called @copilot-mcp/apex was discovered acting as a post-install dropper that delivers a macOS infostealer to any machine running npm install or npx @copilot-mcp/apex. The same payload was distributed via a second dropper, @apexfdn/apex. Researcher SefeDep found the second stage decrypts a 707-line AppleScript via osascript, then phishes the user's login password through a fake system prompt before harvesting browser credentials, more than 20 crypto wallets, SSH keys, AWS and Kubernetes credentials, the macOS login Keychain, Telegram data, and shell history. The data is zipped to /tmp/osalogging.zip and exfiltrated via chunked HTTPS PUT requests. A persistent LaunchAgent polls the attacker's command-and-control server every 60 seconds to keep the infection alive. Developers concerned about credential exposure should verify reused passwords against known leaks using a password checker.

In a parallel supply chain compromise, a rogue Visual Studio Code marketplace extension called "Markdown All Pro" (markdown.markdown-all-pro) was caught impersonating the legitimate "Markdown All in One" extension, which has more than 14 million downloads. According to Manifold Security, the counterfeit beaconed the machine's username and hostname to a hardcoded IP over cleartext HTTP on install, then fetched a remote payload to disk with no user interaction required. Once installed, it opened a channel for the operator to push additional commands without modifying the extension again. Researchers also highlighted an August 18, 2026 GitHub deadline: support bundle uploads from unpatched GitHub Enterprise Server appliances will be rejected, requiring updates to at least versions 3.21.3, 3.20.5, 3.19.9, 3.18.12, or 3.17.18.

Beyond supply chain risks, this week's bulletin also featured threats against industrial control systems, Android spyware disguised as a safety application, and a novel AI attack vector. Attackers demonstrated prompt injection through images, hiding instructions inside image files that manipulated AI agents into executing unintended commands. The same pattern echoes across AI-powered tooling: hidden instructions buried in ordinary-looking content can turn helpful assistants into unwitting accomplices.

For readers who want to confirm whether their credentials have already surfaced in known breaches, an email breach checker provides a quick baseline, while a privacy checkup can reveal other misconfigurations across your digital footprint. Subscribe to the weekly ThreatsDay Bulletin for timely coverage of new malware families, supply chain incidents, and emerging AI attack techniques.