Malicious code in @copilot-mcp/apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c95a10852a2ffe12a9d2b124d014e2092dc2f2d45821ab92feae8cb5308b94ea install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript with 'do shell script' on macO...