{
  "entry": {
    "kind": "vuln",
    "slug": "apex-accelerator-ref8801-a-fake-web3-accelerator-s-npm-coding-agent",
    "name": "apex-accelerator-ref8801-a-fake-web3-accelerator-s-npm-coding-agent",
    "vendor": "npm @apexacc/cli and @apexacc/audit",
    "description": "Elastic Security Labs (Jia Yu Chan, Daniel Stepanic) published REF8801 on 12 October 2026, about an operation posing as a Web3 accelerator (\"Apex Arena\") that offered crypto founders free Claude and Gemini credits, coding tools and security audits. Its npm packages were malicious from the first release. @apexacc/cli (\"Apex Copilot\") repackages the open-source Oh My Pi coding agent, with 1,351 of its 1,363 agent source files identical, and adds a bootstrap. The bootstrap overwrites OPENROUTER_API_KEY and OPENROUTER_BASE_URL so that model requests, including file contents returned by local tools, go to arena.apexaccs[.]org. It also writes a persistent apex-copilot entry in ~/.apex/agent/mcp.json pointing at an attacker MCP server whose instructions and tools land in the agent's prompt, and the captured source defaults tool approvals to yolo. @apexacc/audit presents itself as an 18-tool MCP security-audit server but returns hard-coded or random findings, and tries to register itself in Claude Desktop, Cursor and Windsurf configs. Both launchers fetch a server-chosen command from vrf.apexaccs[.]org. On macOS that leads to the CloudSyncD backdoor, which phishes the admin password. On Windows a staged chain excludes its folder from Defender, tries to turn off Smart App Control, bypasses UAC and drops a native stealer that sends data out through Telegram, including Claude, Cursor and Windsurf config and auth files.",
    "website": "https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-10-12",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "apex-accelerator-ref8801-a-fake-web3-accelerator-s-npm-coding-agent",
      "aliases": [
        "ti-148"
      ],
      "title": "Apex Accelerator (REF8801): A Fake Web3 Accelerator's npm Coding Agent Repackaged Oh My Pi, Rerouted Its LLM Traffic and Registered an Attacker MCP Server",
      "summary": "Elastic Security Labs (Jia Yu Chan, Daniel Stepanic) published REF8801 on 12 October 2026, about an operation posing as a Web3 accelerator (\"Apex Arena\") that offered crypto founders free Claude and Gemini credits, coding tools and security audits. Its npm packages were malicious from the first release. @apexacc/cli (\"Apex Copilot\") repackages the open-source Oh My Pi coding agent, with 1,351 of its 1,363 agent source files identical, and adds a bootstrap. The bootstrap overwrites OPENROUTER_API_KEY and OPENROUTER_BASE_URL so that model requests, including file contents returned by local tools, go to arena.apexaccs[.]org. It also writes a persistent apex-copilot entry in ~/.apex/agent/mcp.json pointing at an attacker MCP server whose instructions and tools land in the agent's prompt, and the captured source defaults tool approvals to yolo. @apexacc/audit presents itself as an 18-tool MCP security-audit server but returns hard-coded or random findings, and tries to register itself in Claude Desktop, Cursor and Windsurf configs. Both launchers fetch a server-chosen command from vrf.apexaccs[.]org. On macOS that leads to the CloudSyncD backdoor, which phishes the admin password. On Windows a staged chain excludes its folder from Defender, tries to turn off Smart App Control, bypasses UAC and drops a native stealer that sends data out through Telegram, including Claude, Cursor and Windsurf config and auth files.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Supply chain compromise",
        "Malware"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "npm @apexacc/cli and @apexacc/audit",
        "vendor": null,
        "package": null,
        "ecosystem": "npm",
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "npm @apexacc/cli and @apexacc/audit, all versions (malicious from publication). The listed agents are not vulnerable: their MCP configs are registration targets and their config and auth files are stealer loot.",
          "fixed": null
        }
      ],
      "exploited": true,
      "exploitPublic": false,
      "publishedAt": "2026-10-12",
      "modifiedAt": "2026-10-12",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages"
        }
      ],
      "mitigation": "Block and remove @apexacc/cli and @apexacc/audit, delete ~/.apex and ~/.apex-audit plus any apex-copilot or apex-audit entries in MCP client configs, and block the published apexaccs[.]org, apexfdn[.]xyz, ccmihr[.]com, 0auth-chromium[.]com and ehegisnightmare[.]icu infrastructure. Treat a machine that ran either package as compromised: rebuild it, and from a clean device rotate browser-saved passwords, wallet keys, model provider keys and the credentials in Claude, Cursor and Windsurf configs. Install coding agents and MCP servers only from their official publisher, and check that an agent's model base URL and MCP server list have not been changed.",
      "detectedByAnomity": true
    }
  }
}