# The Week Attackers Wore Your Tools' Faces
Malware used to announce itself. Ransomware locked your screen. Worms crashed your network. You knew something was wrong. This week's threat roundup covers a different kind of problem — one where the attack surface is trust itself, and where the payload arrives wearing the logo of a tool you already use every day.
## When npm install Is the Vulnerability
Let's start with the one that should concern every developer on a Mac.
A package named @copilot-mcp/apex appeared in the npm registry doing exactly what its name implied: nothing obviously threatening. It positioned itself as an MCP (Model Context Protocol) integration — the kind of glue layer developers increasingly bolt onto AI tooling. Run npm install or npx @copilot-mcp/apex, and you've already lost.
What follows is surgical. On macOS, the dropper decrypts an AppleScript payload that mimics a system authentication prompt — the kind macOS throws up constantly for benign reasons. When you type your password, you've just handed it to an AMOS-family stealer that proceeds to harvest browser credentials, over 20 cryptocurrency wallets, SSH keys, AWS and Kubernetes credentials, your login Keychain, Telegram session data, and shell history. Everything lands in /tmp/osalogging.zip and gets chunked over HTTPS to attacker infrastructure.
Then a LaunchAgent installs itself to poll the command-and-control server every 60 seconds. The initial theft is the opening act. The persistence is the feature.
A second dropper, @apexfdn/apex, distributed the same payload. Both are now pulled. The window they occupied in the registry is the question nobody wants to answer honestly.
## VS Code Marketplace: Still a Trust Problem
The fake VS Code extension story is almost identical in structure, which is what makes it worth dwelling on.
"Markdown All Pro" (markdown.markdown-all-pro) impersonated "Markdown All in One," a legitimate extension with over 14 million downloads. The name was close enough to pass a casual glance. Installing it beaconed your username and hostname to a hardcoded IP over cleartext HTTP — no TLS, no obfuscation, because why bother? — and fetched a remote file whose contents the attacker controlled and could change at will.
Microsoft pulled it. It reappeared under a different identifier with the same display name. Microsoft pulled that one too.
This is the second time in recent memory that Microsoft's VS Code marketplace has hosted a malicious impersonator of a high-download extension. The platform's review process is not equipped to handle adversaries who iterate. Developers who trust the download count as a quality signal are the ones at risk.
## The Platform Responses Worth Watching
Both PyPI and GitHub moved this week on long-standing structural weaknesses, and both moves deserve more attention than they've gotten.
PyPI is now rejecting file uploads to releases older than 14 days. The reasoning is precise: if a publishing token or workflow is compromised, an attacker who can't insert malicious code into a *new* release can still quietly poison an *old* one — a stable version that thousands of projects pin to because stability is the whole point. PyPI's own words: "This has not yet been abused, but there is no technical reason beyond that attackers weren't aware it was possible."
That sentence is a gift to defenders. Read it slowly.
GitHub, meanwhile, is requiring GHES installations to patch before August 18 or lose the ability to upload support bundles via command line. The minimum versions are 3.17.18, 3.18.12, 3.19.9, 3.20.5, and 3.21.3. This is the kind of thing that sounds administrative until you consider what support bundles contain — diagnostic data, configurations, potentially credentials — and what it means when that channel isn't secured.
## A Safety App, an AI That Follows Image Instructions, and the Shape of Next Year's Threats
The headline mentions Android spyware, PLC attacks, and AI image prompt injection, and I want to linger on the last one.
Prompt injection via image is not a new research finding. But it's increasingly practical as AI agents get deployed with the ability to take actions — browse, write, execute — based on what they perceive in images. An attacker embeds instructions in an image. The agent reads the image as part of its context. The instructions execute. The user sees nothing unusual because the image looks fine to human eyes.
This is the attack surface that opens the moment you give an AI agent the ability to act on anything it can perceive. Every organization deploying agentic AI in workflows that touch external content — web browsing, email processing, document analysis — should treat this as an active threat category, not a theoretical one.
The "safety app became spyware" story, while details were truncated in source material, fits a pattern that keeps emerging: applications granted elevated device permissions for legitimate-sounding purposes (location tracking for family safety, health monitoring, network analysis) that are either compromised after acquisition or were designed for surveillance from the start. The permission model that made them functional is the same one that makes them dangerous.
---
## HackWire Analysis
The common thread running through this week's incidents isn't sophistication — it's legitimacy laundering. Every significant attack vector this week operated by borrowing the appearance of something trusted: a developer tool name, a marketplace listing, a system dialog, a package registry, an AI agent's perception layer.
This is not a coincidence. It's a maturation. Attackers have learned that endpoint detection is increasingly effective against novel execution patterns, but almost useless against a signed AppleScript running under the user's own credentials after a legitimate-looking auth prompt. They've learned that a VS Code extension with the right display name will get installed before anyone checks the publisher ID.
What's missing from most coverage of these incidents is the second-order implication: the mitigation posture defenders have built over the last decade — least privilege, endpoint detection, email filtering, perimeter controls — was optimized for a threat model where malware looks like malware. It increasingly doesn't.
The PyPI 14-day upload restriction is the right kind of thinking: don't wait for an abuse case, close the structural opening before it's exploited at scale. GitHub's GHES enforcement is the same instinct. These are rare examples of platforms acting on "no technical reason attackers weren't aware of it" rather than "we saw it happen and then responded."
Defenders right now should be auditing every installed VS Code extension against its publisher ID (not its display name), reviewing npm dependencies for anything that touches AI tooling infrastructure (MCP integrations are a new and under-scrutinized category), and taking seriously the question of what their AI agents are permitted to do after reading external content.
The threat surface expanded this week. Most of it looked like a feature.
— HackWire Editorial
---
## Related Coverage