Malicious npm packages delivering a cross-platform infostealer via a postinstall dropper. On install (npm install / npx), the dropper downloads a 120-150MB binary from an attacker GitHub release and executes it; on macOS it runs an AppleScript payload that phishes the login password via a fake system dialog and steals Login Keychain/iCloud keys, cookies and saved passwords from 17+ browsers, 20+ desktop crypto wallets and 100+ wallet extensions, SSH (~/.ssh), AWS (~/.aws) and Kubernetes (~/.kube) credentials, Telegram tdata, shell history and documents, exfiltrating to a C2 over HTTPS and persisting via a LaunchAgent that polls every 60s. The packages impersonate GitHub Copilot. Packages: @copilot-mcp/apex, @apexfdn/apex (both removed by npm), and @apexfdn/copilot-mcp (operator-controlled runtime cover). Single operator; dropper republished under a new scope within 11 hours of the first takedown. C2: update.apex-arena-router.com / 172.93.185.150; operator domain apexfdn.xyz; binary host GitHub org Apex-Foundation.