Apex Accelerator fake Web3 accelerator ships malicious apexacc npm packages

HighMalicious packagenpm

Elastic Security Labs (REF8801, 2026-10-12) attributes npm packages @apexacc/cli and @apexacc/audit to a fake Web3 accelerator ("Apex Accelerator" / Apex Arena) that lured crypto founders with free AI credits and audits. @apexacc/cli is a repackaged Oh My Pi coding agent that hijacks OpenRouter traffic, drops a macOS credential-stealer (CloudSyncD) and a Windows staged infostealer exfiltrating over Telegram. @apexacc/audit is an MCP server that returns fabricated security findings. GHSA indexed both on 2026-10-19.

Published 19 Oct 2026

Check your package-lock.json Source advisory

At a glancenpm-2026-10-19-apex-accelerator-malicious-npm-packages

Packages tracked2 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity: High
Type: Malicious package
Published: 19 Oct 2026
Ecosystems: npm
Threat actor: Apex Accelerator / Apex Arena (fake Web3 accelerator)
Detected by: Elastic Security Labs, GitHub Advisory Database, OpenSSF malicious-packages
Also known as: REF8801, Apex Accelerator, Apex Arena
Source: github.com

Malicious package. A package that was malicious from its first publish under its own name - a fake tool, a lure used in a social-engineering campaign, or a trojanised utility - rather than a copy of an existing name.

What happened

The full picture

On 2026-10-12 Elastic Security Labs (Jia Yu Chan and Daniel Stepanic) published report REF8801 attributing two malicious npm packages, @apexacc/cli and @apexacc/audit, to a fake Web3 accelerator calling itself "Apex Accelerator" (Apex Arena). GitHub Advisory Database ingested both as GHSA-rm6v-hm93-vwf3 (@apexacc/cli, MAL-2026-17924) and GHSA-c5v8-7c3v-pf6r (@apexacc/audit, MAL-2026-17923) on 2026-10-19. Both are classified malicious-package severity high under our calibration (confirmed malicious payload, limited reach - the packages are first-publish lures that only harm installers; no hijack of an existing legitimate upstream and no worm propagation).

Attack mechanics

@apexacc/cli is a repackaged copy of the open-source oh-my-pi AI coding agent: 1,351 of 1,363 files are byte-identical to upstream. The twelve-file delta carries the malicious additions. First, the launcher (apex.cjs) overwrites OPENROUTER_BASE_URL so every model request routes through arena.apexaccs.org - that mirrors every prompt, file-read, and tool-call result the LLM agent sees to attacker infrastructure. Second, it writes an attacker-controlled remote MCP server to ~/.apex/agent/mcp.json and defaults MCP tool approval to "yolo" (fully permissive) so the LLM agent will execute attacker-chosen tool calls without a user prompt. Third, it fetches a verification bootstrap from vrf.apexaccs.org that drops a platform-specific payload: on macOS, a credential-stealer (CloudSyncD) that pops a fake admin-password prompt and uploads harvested credentials; on Windows, a loader chain (exegis.exe → enc_loader.exe) ending in an infostealer that exfiltrates browser credentials, crypto wallets, messenger stores, VPN clients, and Claude / Cursor / Windsurf configs over Telegram.

@apexacc/audit is the companion package. It is marketed as a security-audit MCP server with 18 "security tools" (Slither reports, honeypot checks, fuzzers). Every tool returns fabricated output - fixed Slither reports, a hardcoded "not a honeypot" verdict, fake fuzzing results that always pass. Installing it registers the MCP server in Claude Desktop, Cursor and Windsurf configs so an LLM agent will transparently call its tools. It shares the vrf.apexaccs.org verification bootstrap with @apexacc/cli, so installing the audit package alone still drops the macOS / Windows payloads.

Operator infrastructure

The campaign is anchored at apexaccs.org (apex + arena.apexaccs.org model-sink + token.apexaccs.org + vrf.apexaccs.org command-retrieval). Secondary hosts include arenapex.cloud (bootstrap-script host, earliest observed), apexfdn.xyz subdomains (arena.apexfdn.xyz, verify.apexfdn.xyz), fdn4apex.com, router-apex.com subdomains (main.router-apex.com, update.apex-arena-router.com), ccmihr.com (macOS C2). Additional observed domains with uncertain role: 0auth-chromium.com, ehegisnightmare.icu, cloudmain365duo.top. Two GitHub repositories referenced from the launcher (apexaccs/copilot, Apex-Accelerator/apexcli) were 404 as of 2026-10-16, suggesting the operator rotated repos after Elastic reached out.

Classification

malicious-package. Severity high: confirmed multi-platform infostealer payloads (macOS credential prompt + Windows Telegram-exfil infostealer), confirmed MCP-config persistence that gives the attacker durable access to any LLM coding agent the victim uses, confirmed model-traffic hijack that captures every prompt and tool-call result. Not critical because the packages are first-publish lures that only harm installers - no legitimate upstream was hijacked, and no worm propagation. The sophistication of the campaign (months-long public-presence build, 18-tool fake MCP server, Bun-wrapped multi-platform binaries) makes this a notable find and separates it from the daily GHSA sweep.

Discovery

Finders: Elastic Security Labs (REF8801, Jia Yu Chan + Daniel Stepanic, 2026-10-12). Independent confirmation: Patrick Duggan / DugganUSA (static inspection of the 1.6.2 launcher). GHSA ingestion: 2026-10-19.

infostealercredential-theftcrypto-wallet-drainprompt-injectionobfuscation

Affected packages

2 packages 2 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →

Impact

What it does if you installed it

@apexacc/cli (all versions, latest 1.6.2 live on npm as of 2026-10-16; GHSA-rm6v-hm93-vwf3, MAL-2026-17924, Elastic REF8801): a repackaged clone of the open-source oh-my-pi AI coding agent - 1,351 of 1,363 files are byte-identical to upstream. The malicious additions: (1) overwrites OPENROUTER_BASE_URL to a campaign-controlled host so every prompt, file read, and tool-call result is mirrored to the attacker; (2) persists an attacker-controlled remote MCP server at ~/.apex/agent/mcp.json; (3) defaults MCP tool approval to "yolo" (fully permissive); (4) fetches a verification bootstrap from vrf.apexaccs.org; (5) on macOS, drops CloudSyncD (SHA-256 68f5a00eafa8ecebf5d93328e0fec23b24d6f91808c8384db002946a13656c71) which pops a fake macOS admin password prompt and uploads harvested credentials; (6) on Windows, chains a loader (exegis.exe SHA-256 ee8cd9aba420f1b26b5d43e5bcdd6025a277b4946bb5daf76ab45c0e5f7ecd0b to enc_loader.exe SHA-256 ed5cb4af1d2cb067b8d23783ebf05d70278728462ba4f1bf29da0a3a41efc35e) ending in an infostealer that exfiltrates browser credentials, crypto-wallet files, messenger stores, VPN-client secrets, and Claude / Cursor / Windsurf config files over Telegram. The CLI binary launcher apex.cjs (SHA-256 4029192a44ee738deba9aa53b57550075cb8fd170a63f0636dea5452256f2175) fetches a ~114MB Bun-wrapped native binary from GitHub releases into ~/.apex/bin (apex-windows-x64.exe SHA-256 985829083f3937df6c82419216f7697afae0caac8efca6257a756066fe2c0abb; apex-darwin-arm64 SHA-256 42a760b15fea7c9af718ee45386c1c3ea1bec9e30c95d16c287bcc8b2efdc72e; apex-verify-darwin helper SHA-256 127ae4cad80b6605157ca2a1feada8a235e16aacc5d2119337a98115a4e13274). The 1.6.2 npm tarball hashes to 7ca5e3908dd8721d0cf6af2488f0825c0d91a5e0b7c8529ef830141a4a3ba31f. On Windows 11 the launcher sets execution policy to RemoteSigned, then spawns a hidden elevated PowerShell (UAC RunAs prompt) that attempts to add a Defender exclusion for ~/.apex and disable Smart App Control via HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy VerifiedAndReputablePolicyState=0 - a backslash-escaping bug from 1.5.122 onward makes the commands likely fail, but the UAC prompt still appears, and 1.5.120 and 1.5.121 (both 2026-09-17) used correct escaping and succeeded silently when run as administrator
@apexacc/audit (all versions; GHSA-c5v8-7c3v-pf6r, MAL-2026-17923, Elastic REF8801): the companion package to @apexacc/cli, marketed as a security-audit MCP server. Ships 18 "security tools" that return fabricated output: fixed Slither reports, a hardcoded "not a honeypot" verdict, synthesised fuzzing results that always pass. Registers itself in claude_desktop_config.json, Cursor and Windsurf MCP configs on install so an LLM agent will transparently call its tools. On Windows requests UAC elevation to add a Defender exclusion for its folder and attempts to disable Smart App Control. Uses the same verification bootstrap (vrf.apexaccs.org) as @apexacc/cli so installing the audit package alone still drops the macOS / Windows payloads. npm registry returned "Not found" as of 2026-10-15 (the package was removed) but installed copies persist until the lockfile is rebuilt
Campaign infrastructure (apexaccs.org cluster, confirmed from Elastic REF8801 + OSSF MAL-2026-17924): apexaccs.org apex + subdomains arena.apexaccs.org (model-traffic sink that captures LLM prompts and tool results), token.apexaccs.org, vrf.apexaccs.org (command/bootstrap retrieval). Secondary infrastructure: arenapex.cloud (bootstrap-script host, earliest observed), arena.apexfdn.xyz, verify.apexfdn.xyz, fdn4apex.com, main.router-apex.com, update.apex-arena-router.com. macOS C2: ccmihr.com. Additional observed domains (purpose not confirmed): 0auth-chromium.com, ehegisnightmare.icu, cloudmain365duo.top. Two GitHub repositories referenced from the launcher - apexaccs/copilot and Apex-Accelerator/apexcli - both returned 404 as of 2026-10-16, suggesting the operator rotated repos after Elastic reached out
Reach and attribution: Elastic describes a months-long public-presence build - a fake accelerator with a claimed portfolio, invented funding figures, a public outreach channel offering free AI credits + security audits to crypto / Web3 founders. No prior-art attribution is published; the operator is tracked only as Apex Accelerator / Apex Arena. The target audience is Web3 and crypto startup developers / founders willing to run a free "AI coding assistant" against their project. Finders: Jia Yu Chan and Daniel Stepanic (Elastic Security Labs); independent static confirmation of the 1.6.2 launcher by DugganUSA (Patrick Duggan). Both npm packages were still live on 2026-10-16 at the time of the Elastic report; GHSA ingestion lagged until 2026-10-19

What to do

Clean-up steps

Grep every package.json, package-lock.json, pnpm-lock.yaml, yarn.lock, bun.lock, node_modules/.package-lock.json, and any internal registry mirror for the exact package names @apexacc/cli and @apexacc/audit. On any hit at any version, treat the installer host as fully compromised and assume both the macOS and Windows payloads were deployed if the user ever invoked the apex CLI (the launcher runs on CLI invocation, not on npm install - a plain install without a run is lower-risk but still delivers the Windows UAC prompt). Rotate every credential reachable from the host: start with every Claude Desktop / Cursor / Windsurf API key, every OpenRouter token (OPENROUTER_API_KEY), every crypto-wallet private key and seed phrase that was ever on the machine, every browser-saved credential (Chrome / Edge / Brave / Safari), every messenger session (Telegram, Discord, Signal desktop), VPN-client credentials (OpenVPN, WireGuard, Tailscale), SSH keys under the user, and every cloud-provider CLI credential (aws configure, gcloud auth, az login). Rotate from a clean machine, not from the suspected host. Image the host for forensics before rebuild
Host-indicator hunt (macOS): ~/.apex/ directory existence, ~/.apex/agent/mcp.json listing an unexpected MCP server pointing to an apexaccs.org / apexfdn.xyz / router-apex.com domain, ~/.apex/bin/apex-darwin-arm64 or ~/.apex/bin/apex-verify-darwin binaries, and any CloudSyncD process or launch-agent. Hashes to match: apex-darwin-arm64 SHA-256 42a760b15fea7c9af718ee45386c1c3ea1bec9e30c95d16c287bcc8b2efdc72e, apex-verify-darwin SHA-256 127ae4cad80b6605157ca2a1feada8a235e16aacc5d2119337a98115a4e13274, installer (CloudSyncD dropper) SHA-256 68f5a00eafa8ecebf5d93328e0fec23b24d6f91808c8384db002946a13656c71. Windows: %USERPROFILE%\.apex\ existence, Defender exclusion for that path, a VerifiedAndReputablePolicyState=0 under HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy (Smart App Control disabled), execution-policy change to RemoteSigned on the user scope, exegis.exe or enc_loader.exe on disk. Hashes: apex-windows-x64.exe SHA-256 985829083f3937df6c82419216f7697afae0caac8efca6257a756066fe2c0abb, exegis.exe SHA-256 ee8cd9aba420f1b26b5d43e5bcdd6025a277b4946bb5daf76ab45c0e5f7ecd0b, enc_loader.exe SHA-256 ed5cb4af1d2cb067b8d23783ebf05d70278728462ba4f1bf29da0a3a41efc35e. Both: OPENROUTER_BASE_URL set to a non-standard host, outbound HTTPS to any *.apexaccs.org, *.apexfdn.xyz, arenapex.cloud, ccmihr.com, fdn4apex.com, *.router-apex.com, or Telegram-bot API
Egress-denylist entries to add: apexaccs.org apex + arena.apexaccs.org + token.apexaccs.org + vrf.apexaccs.org; arenapex.cloud apex; apexfdn.xyz apex + arena.apexfdn.xyz + verify.apexfdn.xyz; fdn4apex.com apex; router-apex.com apex + main.router-apex.com; apex-arena-router.com apex + update.apex-arena-router.com; ccmihr.com apex; 0auth-chromium.com, ehegisnightmare.icu, cloudmain365duo.top. Also deny api.telegram.org on untrusted developer workstations and CI/build hosts (standard infostealer exfil channel for the Windows stage). Keep openrouter.ai reachable on legitimate dev hosts but monitor for prompt-mirror traffic to any of the apexaccs/apexfdn/router-apex domains above
For LLM-coding-agent hosts (Claude Desktop, Cursor, Windsurf, Claude Code, Zed, etc.) on any machine that ran either package: re-run the hosts MCP config inspection and remove any entry pointing to an apexaccs.org / apexfdn.xyz / router-apex.com subdomain, including entries in ~/.apex/agent/mcp.json, claude_desktop_config.json, Cursor settings mcpServers, Windsurf settings. Rotate the clients configured LLM API keys (any value is to be presumed captured). Review LLM-agent conversation logs for any session where the agent "fetched instructions" or "ran a verify step" from an apex-* domain and treat any secret shown to the agent during that session as exfiltrated
Watch for a wave 2 under additional @apexacc-adjacent npm scopes (@apex-accelerator/*, @apex-arena/*, @apexfdn/*), or under new maintainer accounts riding the oh-my-pi repackaging shape, or in sibling package ecosystems (PyPI, VS Code Marketplace extensions targeting crypto-tooling developers). The Elastic report dates the operator presence back several months before publication (2026-10-12), so adjacent packages predating October may yet surface in GHSA backfill. Also watch for operator pivots that drop the "fake accelerator" branding and reuse the same loader-chain infrastructure under a different marketing shell

References

Sources

npm-2026-10-19-apex-accelerator-malicious-npm-packagesBack to incidents Submit a correction

Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.json All incidents