On 12 October 2026, Elastic Security Labs published an analysis of two npm packages, @apexacc/cli and @apexacc/audit, distributed by a group posing as a Web3 accelerator called Apex. The group offered crypto founders free AI credits, an AI coding assistant and security audits. Elastic found the tools installed stealers and backdoors on macOS and Windows, routed the coding agent's model requests through attacker servers, and returned fabricated audit results.
What's affected
@apexacc/cli, sold as "Apex Copilot". Elastic says it repackages the open-source coding agent Oh My Pi and analysed version 1.6.1. The registry shows 122 versions, the first published on 9 August 2026 and the latest, 1.6.2, on 27 September. When we checked on 18 October, the package was still listed with npm's "Package no longer supported" deprecation notice, and OSV returned no record for it.@apexacc/audit, an MCP server advertising 18 smart contract security tools. Elastic found every tool returns hard-coded or random output.audit_honeypotalways answers "NOT A HONEYPOT", andaudit_token_riskusesMath.random(). The npm registry returns "Not found" for this package today.
How the CLI works, per Elastic:
- The
binentry runsapex.cjs(oraudit.cjs), which downloads a platform-specific executable from GitHub releases, caches it in the home directory and launches it. - The bootstrap posts the platform name to
vrf.apexaccs[.]organd executes whatever command comes back. - On Windows, that leads through PowerShell and VBScript launchers to a native stealer that exfiltrates over Telegram. On macOS, a Rust helper pipes a remote script to
shand installs a backdoor Elastic calls CloudSyncD, which shows a fake "Shared library version mismatch" error to ask for the admin password.
The AI-specific part is the agent hijack. At run time the CLI sets OPENROUTER_BASE_URL to arena.apexaccs[.]org/api/llm/v1 and OPENROUTER_API_KEY to a token from the Apex dashboard, so requests that look like OpenRouter calls go to the attacker. It also writes an apex-copilot MCP server entry into ~/.apex/agent/mcp.json that persists across restarts. Elastic confirmed that local file contents read by the agent reached the attacker's endpoint. It did not observe tampered model responses.
Elastic's indicator list also includes older apexfdn[.]xyz domains. OSV has a malware record, MAL-2026-10979, for an npm package named @apexfdn/apex, published on 21 July 2026.
How to check if you're exposed
On developer machines, look for the packages and their artifacts:
npm ls -g --depth=0 2>/dev/null | grep -E '@apexacc|@apexfdn'
grep -rnE '@apexacc/|@apexfdn/' --include=package.json --include=package-lock.json ~ 2>/dev/null | head
ls -la ~/.apex ~/.apex-audit ~/.config/cloudsync ~/.local/share/cloudsync 2>/dev/null
env | grep -i OPENROUTER_BASE_URL
On Windows, check for %APPDATA%\.cobra, %TEMP%\_apex_run.ps1 and %TEMP%\_audit_run.ps1, and for a Defender exclusion on %USERPROFILE%\.apex-audit:
Test-Path "$env:APPDATA\.cobra"
Get-ChildItem $env:TEMP -Filter '_*_run.*'
(Get-MpPreference).ExclusionPath
In DNS and proxy logs, search for apexaccs.org and its subdomains (arena, vrf, token), apexfdn.xyz, ccmihr.com and 0auth-chromium.com. Also review every MCP configuration file your agents load and ask whether you added each server yourself.
What to do now
- Treat any machine that ran the CLI or audit tool as compromised. It executed a remote command chosen by the server. Rebuild it rather than clean it.
- Rotate everything from a clean device. Browser-saved passwords and sessions, wallet seed phrases and keys, exchange API keys, SSH keys, cloud credentials and any secrets in files the agent could read. On macOS, change the account password you typed into the fake error dialog.
- Remove agent configuration you didn't write. Delete the
apex-copilotMCP entry and any base URL overrides, and check other agents' configuration files on the same machine. - Block the domains in Elastic's indicator list at DNS and proxy.
- Put AI tools through the same intake as other software. A coding agent or MCP server can read your files and run commands. Install it only from a source you've verified, with its model endpoint and MCP servers reviewed.
Why it matters
This was not a typosquat waiting for a mistyped name. It was a months-long social engineering operation with a website, fake reviews, an event invitation page around TOKEN2049 in Singapore, and an npm package as the delivery step. The target was a founder or developer who wanted free AI credits.
AI coding agents raise the stakes. They read source files, .env files and keys as part of normal work, and they send that context to a model endpoint. Change the endpoint, and the attacker receives a curated feed of your most sensitive files without needing to search the disk. Treat the base URL and MCP list of every agent as security configuration, and monitor them like you would a proxy setting.
Try it yourself
On your own machine, list every MCP server and model endpoint your coding tools are configured to use. Check the global and project-level config files for each tool you run, plus any *_BASE_URL environment variables in your shell profile. For each entry, write down who added it and what it can reach. Anything nobody can explain is worth removing.
Click through it at your own pace, or open it full screen.
Quick check
How did Apex Copilot capture the agent's traffic?
It overwrote the OpenRouter base URL and API key at run time so model requests went to arena.apexaccs.org, and it added a persistent MCP server entry pointing to the same host.
Did @apexacc/audit actually scan contracts?
No. Elastic found all 18 tools return hard-coded, formatted or random output. The honeypot check always says "NOT A HONEYPOT".
Is removing the npm package enough?
No. The CLI ran server-supplied commands that installed stealers and backdoors outside node_modules, so the machine needs a rebuild and credential rotation.
