# Apex Accelerator fake Web3 accelerator ships malicious apexacc npm packages

> Elastic Security Labs (REF8801, 2026-10-12) attributes npm packages `@apexacc/cli` and `@apexacc/audit` to a fake Web3 accelerator ("Apex Accelerator" / Apex Arena) that lured crypto founders with free AI credits and audits. `@apexacc/cli` is a repackaged Oh My Pi coding agent that hijacks OpenRouter traffic, drops a macOS credential-stealer (`CloudSyncD`) and a Windows staged infostealer exfiltrating over Telegram. `@apexacc/audit` is an MCP server that returns fabricated security findings. GHSA indexed both on 2026-10-19.

- Published: 2026-10-19
- Severity: high
- Kind: Malicious package - A package that was malicious from its first publish under its own name - a fake tool, a lure used in a social-engineering campaign, or a trojanised utility - rather than a copy of an existing name.
- Ecosystems: npm
- Scope: 2 packages, 2 compromised versions
- Tags: infostealer, credential-theft, crypto-wallet-drain, prompt-injection, obfuscation
- Threat actor: Apex Accelerator / Apex Arena (fake Web3 accelerator)
- Also known as: REF8801, Apex Accelerator, Apex Arena, apexaccs.org Web3 developer-targeting operator
- Detected by: Elastic Security Labs, GitHub Advisory Database, OpenSSF malicious-packages
- Incident ID: npm-2026-10-19-apex-accelerator-malicious-npm-packages

## Affected packages (2)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@apexacc/audit](https://dependencywatch.io/package/npm/@apexacc/audit) | npm | * |
| [@apexacc/cli](https://dependencywatch.io/package/npm/@apexacc/cli) | npm | * |

## What happened

On 2026-10-12 Elastic Security Labs (Jia Yu Chan and Daniel Stepanic) published report **REF8801** attributing two malicious npm packages, `@apexacc/cli` and `@apexacc/audit`, to a fake Web3 accelerator calling itself "Apex Accelerator" (Apex Arena). GitHub Advisory Database ingested both as GHSA-rm6v-hm93-vwf3 (`@apexacc/cli`, MAL-2026-17924) and GHSA-c5v8-7c3v-pf6r (`@apexacc/audit`, MAL-2026-17923) on 2026-10-19. Both are classified `malicious-package` severity `high` under our calibration (confirmed malicious payload, limited reach - the packages are first-publish lures that only harm installers; no hijack of an existing legitimate upstream and no worm propagation).

## Attack mechanics

`@apexacc/cli` is a repackaged copy of the open-source `oh-my-pi` AI coding agent: 1,351 of 1,363 files are byte-identical to upstream. The twelve-file delta carries the malicious additions. First, the launcher (`apex.cjs`) overwrites `OPENROUTER_BASE_URL` so every model request routes through `arena.apexaccs.org` - that mirrors every prompt, file-read, and tool-call result the LLM agent sees to attacker infrastructure. Second, it writes an attacker-controlled remote MCP server to `~/.apex/agent/mcp.json` and defaults MCP tool approval to "yolo" (fully permissive) so the LLM agent will execute attacker-chosen tool calls without a user prompt. Third, it fetches a verification bootstrap from `vrf.apexaccs.org` that drops a platform-specific payload: on macOS, a credential-stealer (`CloudSyncD`) that pops a fake admin-password prompt and uploads harvested credentials; on Windows, a loader chain (`exegis.exe` → `enc_loader.exe`) ending in an infostealer that exfiltrates browser credentials, crypto wallets, messenger stores, VPN clients, and Claude / Cursor / Windsurf configs over Telegram.

`@apexacc/audit` is the companion package. It is marketed as a security-audit MCP server with 18 "security tools" (Slither reports, honeypot checks, fuzzers). Every tool returns fabricated output - fixed Slither reports, a hardcoded "not a honeypot" verdict, fake fuzzing results that always pass. Installing it registers the MCP server in Claude Desktop, Cursor and Windsurf configs so an LLM agent will transparently call its tools. It shares the `vrf.apexaccs.org` verification bootstrap with `@apexacc/cli`, so installing the audit package alone still drops the macOS / Windows payloads.

## Operator infrastructure

The campaign is anchored at `apexaccs.org` (apex + `arena.apexaccs.org` model-sink + `token.apexaccs.org` + `vrf.apexaccs.org` command-retrieval). Secondary hosts include `arenapex.cloud` (bootstrap-script host, earliest observed), `apexfdn.xyz` subdomains (`arena.apexfdn.xyz`, `verify.apexfdn.xyz`), `fdn4apex.com`, `router-apex.com` subdomains (`main.router-apex.com`, `update.apex-arena-router.com`), `ccmihr.com` (macOS C2). Additional observed domains with uncertain role: `0auth-chromium.com`, `ehegisnightmare.icu`, `cloudmain365duo.top`. Two GitHub repositories referenced from the launcher (`apexaccs/copilot`, `Apex-Accelerator/apexcli`) were 404 as of 2026-10-16, suggesting the operator rotated repos after Elastic reached out.

## Classification

`malicious-package`. Severity `high`: confirmed multi-platform infostealer payloads (macOS credential prompt + Windows Telegram-exfil infostealer), confirmed MCP-config persistence that gives the attacker durable access to any LLM coding agent the victim uses, confirmed model-traffic hijack that captures every prompt and tool-call result. Not `critical` because the packages are first-publish lures that only harm installers - no legitimate upstream was hijacked, and no worm propagation. The sophistication of the campaign (months-long public-presence build, 18-tool fake MCP server, Bun-wrapped multi-platform binaries) makes this a notable find and separates it from the daily GHSA sweep.

## Discovery

Finders: `Elastic Security Labs` (REF8801, Jia Yu Chan + Daniel Stepanic, 2026-10-12). Independent confirmation: `Patrick Duggan / DugganUSA` (static inspection of the 1.6.2 launcher). GHSA ingestion: 2026-10-19.

## Impact

- **`@apexacc/cli` (all versions, latest `1.6.2` live on npm as of 2026-10-16; GHSA-rm6v-hm93-vwf3, MAL-2026-17924, Elastic REF8801)**: a repackaged clone of the open-source `oh-my-pi` AI coding agent - 1,351 of 1,363 files are byte-identical to upstream. The malicious additions: (1) overwrites `OPENROUTER_BASE_URL` to a campaign-controlled host so every prompt, file read, and tool-call result is mirrored to the attacker; (2) persists an attacker-controlled remote MCP server at `~/.apex/agent/mcp.json`; (3) defaults MCP tool approval to "yolo" (fully permissive); (4) fetches a verification bootstrap from `vrf.apexaccs.org`; (5) on macOS, drops `CloudSyncD` (SHA-256 `68f5a00eafa8ecebf5d93328e0fec23b24d6f91808c8384db002946a13656c71`) which pops a fake macOS admin password prompt and uploads harvested credentials; (6) on Windows, chains a loader (`exegis.exe` SHA-256 `ee8cd9aba420f1b26b5d43e5bcdd6025a277b4946bb5daf76ab45c0e5f7ecd0b` to `enc_loader.exe` SHA-256 `ed5cb4af1d2cb067b8d23783ebf05d70278728462ba4f1bf29da0a3a41efc35e`) ending in an infostealer that exfiltrates browser credentials, crypto-wallet files, messenger stores, VPN-client secrets, and Claude / Cursor / Windsurf config files over Telegram. The CLI binary launcher `apex.cjs` (SHA-256 `4029192a44ee738deba9aa53b57550075cb8fd170a63f0636dea5452256f2175`) fetches a ~114MB Bun-wrapped native binary from GitHub releases into `~/.apex/bin` (`apex-windows-x64.exe` SHA-256 `985829083f3937df6c82419216f7697afae0caac8efca6257a756066fe2c0abb`; `apex-darwin-arm64` SHA-256 `42a760b15fea7c9af718ee45386c1c3ea1bec9e30c95d16c287bcc8b2efdc72e`; `apex-verify-darwin` helper SHA-256 `127ae4cad80b6605157ca2a1feada8a235e16aacc5d2119337a98115a4e13274`). The 1.6.2 npm tarball hashes to `7ca5e3908dd8721d0cf6af2488f0825c0d91a5e0b7c8529ef830141a4a3ba31f`. On Windows 11 the launcher sets execution policy to `RemoteSigned`, then spawns a hidden elevated PowerShell (UAC `RunAs` prompt) that attempts to add a Defender exclusion for `~/.apex` and disable Smart App Control via `HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy VerifiedAndReputablePolicyState=0` - a backslash-escaping bug from 1.5.122 onward makes the commands likely fail, but the UAC prompt still appears, and 1.5.120 and 1.5.121 (both 2026-09-17) used correct escaping and succeeded silently when run as administrator
- **`@apexacc/audit` (all versions; GHSA-c5v8-7c3v-pf6r, MAL-2026-17923, Elastic REF8801)**: the companion package to `@apexacc/cli`, marketed as a security-audit MCP server. Ships 18 "security tools" that return fabricated output: fixed Slither reports, a hardcoded "not a honeypot" verdict, synthesised fuzzing results that always pass. Registers itself in `claude_desktop_config.json`, Cursor and Windsurf MCP configs on install so an LLM agent will transparently call its tools. On Windows requests UAC elevation to add a Defender exclusion for its folder and attempts to disable Smart App Control. Uses the same verification bootstrap (`vrf.apexaccs.org`) as `@apexacc/cli` so installing the audit package alone still drops the macOS / Windows payloads. npm registry returned "Not found" as of 2026-10-15 (the package was removed) but installed copies persist until the lockfile is rebuilt
- **Campaign infrastructure (apexaccs.org cluster, confirmed from Elastic REF8801 + OSSF MAL-2026-17924)**: `apexaccs.org` apex + subdomains `arena.apexaccs.org` (model-traffic sink that captures LLM prompts and tool results), `token.apexaccs.org`, `vrf.apexaccs.org` (command/bootstrap retrieval). Secondary infrastructure: `arenapex.cloud` (bootstrap-script host, earliest observed), `arena.apexfdn.xyz`, `verify.apexfdn.xyz`, `fdn4apex.com`, `main.router-apex.com`, `update.apex-arena-router.com`. macOS C2: `ccmihr.com`. Additional observed domains (purpose not confirmed): `0auth-chromium.com`, `ehegisnightmare.icu`, `cloudmain365duo.top`. Two GitHub repositories referenced from the launcher - `apexaccs/copilot` and `Apex-Accelerator/apexcli` - both returned 404 as of 2026-10-16, suggesting the operator rotated repos after Elastic reached out
- **Reach and attribution**: Elastic describes a months-long public-presence build - a fake accelerator with a claimed portfolio, invented funding figures, a public outreach channel offering free AI credits + security audits to crypto / Web3 founders. No prior-art attribution is published; the operator is tracked only as `Apex Accelerator` / `Apex Arena`. The target audience is Web3 and crypto startup developers / founders willing to run a free "AI coding assistant" against their project. Finders: Jia Yu Chan and Daniel Stepanic (Elastic Security Labs); independent static confirmation of the 1.6.2 launcher by `DugganUSA` (Patrick Duggan). Both npm packages were still live on 2026-10-16 at the time of the Elastic report; GHSA ingestion lagged until 2026-10-19

## What to do

1. **Grep every `package.json`, `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `bun.lock`, `node_modules/.package-lock.json`, and any internal registry mirror for the exact package names `@apexacc/cli` and `@apexacc/audit`**. On any hit at any version, treat the installer host as fully compromised and assume both the macOS and Windows payloads were deployed if the user ever invoked the `apex` CLI (the launcher runs on CLI invocation, not on `npm install` - a plain install without a run is lower-risk but still delivers the Windows UAC prompt). Rotate every credential reachable from the host: start with every Claude Desktop / Cursor / Windsurf API key, every OpenRouter token (`OPENROUTER_API_KEY`), every crypto-wallet private key and seed phrase that was ever on the machine, every browser-saved credential (Chrome / Edge / Brave / Safari), every messenger session (Telegram, Discord, Signal desktop), VPN-client credentials (OpenVPN, WireGuard, Tailscale), SSH keys under the user, and every cloud-provider CLI credential (`aws configure`, `gcloud auth`, `az login`). Rotate from a clean machine, not from the suspected host. Image the host for forensics before rebuild
2. **Host-indicator hunt (macOS)**: `~/.apex/` directory existence, `~/.apex/agent/mcp.json` listing an unexpected MCP server pointing to an `apexaccs.org` / `apexfdn.xyz` / `router-apex.com` domain, `~/.apex/bin/apex-darwin-arm64` or `~/.apex/bin/apex-verify-darwin` binaries, and any `CloudSyncD` process or launch-agent. Hashes to match: `apex-darwin-arm64` SHA-256 `42a760b15fea7c9af718ee45386c1c3ea1bec9e30c95d16c287bcc8b2efdc72e`, `apex-verify-darwin` SHA-256 `127ae4cad80b6605157ca2a1feada8a235e16aacc5d2119337a98115a4e13274`, `installer` (CloudSyncD dropper) SHA-256 `68f5a00eafa8ecebf5d93328e0fec23b24d6f91808c8384db002946a13656c71`. **Windows**: `%USERPROFILE%\.apex\` existence, Defender exclusion for that path, a `VerifiedAndReputablePolicyState=0` under `HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy` (Smart App Control disabled), execution-policy change to `RemoteSigned` on the user scope, `exegis.exe` or `enc_loader.exe` on disk. Hashes: `apex-windows-x64.exe` SHA-256 `985829083f3937df6c82419216f7697afae0caac8efca6257a756066fe2c0abb`, `exegis.exe` SHA-256 `ee8cd9aba420f1b26b5d43e5bcdd6025a277b4946bb5daf76ab45c0e5f7ecd0b`, `enc_loader.exe` SHA-256 `ed5cb4af1d2cb067b8d23783ebf05d70278728462ba4f1bf29da0a3a41efc35e`. **Both**: `OPENROUTER_BASE_URL` set to a non-standard host, outbound HTTPS to any `*.apexaccs.org`, `*.apexfdn.xyz`, `arenapex.cloud`, `ccmihr.com`, `fdn4apex.com`, `*.router-apex.com`, or Telegram-bot API
3. **Egress-denylist entries to add**: `apexaccs.org` apex + `arena.apexaccs.org` + `token.apexaccs.org` + `vrf.apexaccs.org`; `arenapex.cloud` apex; `apexfdn.xyz` apex + `arena.apexfdn.xyz` + `verify.apexfdn.xyz`; `fdn4apex.com` apex; `router-apex.com` apex + `main.router-apex.com`; `apex-arena-router.com` apex + `update.apex-arena-router.com`; `ccmihr.com` apex; `0auth-chromium.com`, `ehegisnightmare.icu`, `cloudmain365duo.top`. Also deny `api.telegram.org` on untrusted developer workstations and CI/build hosts (standard infostealer exfil channel for the Windows stage). Keep `openrouter.ai` reachable on legitimate dev hosts but monitor for prompt-mirror traffic to any of the apexaccs/apexfdn/router-apex domains above
4. **For LLM-coding-agent hosts (Claude Desktop, Cursor, Windsurf, Claude Code, Zed, etc.)** on any machine that ran either package: re-run the host`s MCP config inspection and remove any entry pointing to an `apexaccs.org` / `apexfdn.xyz` / `router-apex.com` subdomain, including entries in `~/.apex/agent/mcp.json`, `claude_desktop_config.json`, Cursor settings `mcpServers`, Windsurf settings. Rotate the client`s configured LLM API keys (any value is to be presumed captured). Review LLM-agent conversation logs for any session where the agent "fetched instructions" or "ran a verify step" from an apex-* domain and treat any secret shown to the agent during that session as exfiltrated
5. **Watch for a wave 2** under additional `@apexacc`-adjacent npm scopes (`@apex-accelerator/*`, `@apex-arena/*`, `@apexfdn/*`), or under new maintainer accounts riding the `oh-my-pi` repackaging shape, or in sibling package ecosystems (PyPI, VS Code Marketplace extensions targeting crypto-tooling developers). The Elastic report dates the operator presence back several months before publication (2026-10-12), so adjacent packages predating October may yet surface in GHSA backfill. Also watch for operator pivots that drop the "fake accelerator" branding and reuse the same loader-chain infrastructure under a different marketing shell

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-rm6v-hm93-vwf3 - npm @apexacc/cli (all versions, MAL-2026-17924, OPENROUTER_BASE_URL hijack + MCP persistence + macOS CloudSyncD + Windows exegis/enc_loader infostealer, Elastic REF8801 cited)](https://github.com/advisories/GHSA-rm6v-hm93-vwf3) - GitHub
- [GHSA-c5v8-7c3v-pf6r - npm @apexacc/audit (all versions, MAL-2026-17923, 18-tool fake security MCP server registered in Claude Desktop/Cursor/Windsurf; shares verification bootstrap with @apexacc/cli so still drops the macOS and Windows payloads)](https://github.com/advisories/GHSA-c5v8-7c3v-pf6r) - GitHub
- [OSSF malicious-packages MAL-2026-17924 raw record (@apexacc/cli IOCs: full apexaccs.org domain cluster, launcher apex.cjs + apex-windows-x64.exe + apex-darwin-arm64 + apex-verify-darwin + CloudSyncD + exegis.exe + enc_loader.exe SHA-256 hashes, Smart App Control disable registry path, Elastic REF8801 attribution)](https://raw.githubusercontent.com/ossf/malicious-packages/main/osv/malicious/npm/%40apexacc/cli/MAL-2026-17924.json) - OpenSSF
- [Elastic Security Labs: Apex Accelerator malicious npm packages (REF8801, 2026-10-12 - the primary vendor write-up)](https://www.elastic.co/security-labs/apex-accelerator-malicious-npm-packages) - Elastic Security Labs
- [securityonline.info: Apex malicious npm packages Web3 (secondary vendor summary)](https://securityonline.info/apex-malicious-npm-packages-web3/) - Security Online
- [npm package page for @apexacc/cli (registry status; was 1.6.2 as of 2026-10-16, since removed)](https://www.npmjs.com/package/@apexacc/cli) - npm
- [npm package page for @apexacc/audit (registry status; "Not found" as of 2026-10-15 - already removed)](https://www.npmjs.com/package/@apexacc/audit) - npm

---

Canonical page: https://dependencywatch.io/incident/npm-2026-10-19-apex-accelerator-malicious-npm-packages
Markdown version: https://dependencywatch.io/incident/npm-2026-10-19-apex-accelerator-malicious-npm-packages.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).