The Pulse
Fake Apex Accelerator Routed AI Coding Traffic to Its Servers
Elastic Security Labs says the fake Web3 accelerator Apex used malicious npm packages to deliver malware and redirect AI coding-agent traffic. Its researchers found that the packages also installed an attacker-controlled MCP server and offe
AI.info Team · Written with AI · fact-checked ·
On October 12, Elastic Security Labs said a supply-chain monitor had flagged a suspicious npm package, leading researchers to a fake Web3 accelerator called Apex. The operation courted cryptocurrency founders with offers of free AI credits, coding tools and security audits, then used its software to deliver malware and reroute AI coding-agent traffic. Elastic’s Jia Yu Chan and Daniel Stepanic write: “Together, these mechanisms give the attacker visibility into the submitted data and a way to influence the agent’s subsequent actions.”
A supply-chain alert led to a fake accelerator
The first alert concerned @apexacc/cli, an npm package Elastic says was malicious from its initial publication, rather than a legitimate project later compromised. Researchers traced it to an operation presenting Apex Arena as a private workspace for crypto and Web3 founders, backed by an accelerator called Apex. The site claimed more than 200 portfolio projects and over $124 million raised; those were the operation’s claims, not independently verified figures.
Apex promoted investment contacts, startup assessments and downloadable auditing tools. It also used fabricated reviews to bolster its products and advertised an in-person event, adding offline associations to its online pitch. Elastic says the operation had spent months building this public presence and sought visibility at TOKEN2049 in Singapore.
Two npm packages changed the trust boundary
Elastic examined @apexacc/cli, presented as an AI coding assistant, and @apexacc/audit, advertised as an MCP server with 18 security tools. Their npm launchers downloaded platform-specific executables from GitHub releases and ran them on Windows or macOS. A separate verification path fetched commands from attacker-controlled infrastructure, giving the operation a way to execute additional code on a user’s machine.
The coding assistant repackaged the legitimate open-source agent Oh My Pi: Elastic found that 1,351 of 1,363 files in the examined Apex directory matched corresponding files in the original project. Apex’s added bootstrap code redirected model traffic and registered an attacker-controlled MCP server. On Windows, the researchers also found code in the audit package that sought administrator elevation, attempted to add an antivirus exclusion and tried to disable Smart App Control.
The agent sent prompts and file contents to Apex
The bootstrap changed environment variables so requests labeled as OpenRouter traffic went instead to an Apex-controlled endpoint. Elastic’s instrumented test confirmed that an agent request reached that endpoint. The researchers then asked the agent to read a test file; the next request sent to the endpoint contained the file’s contents, which also remained in later conversation requests.
The package also added a persistent entry for an Apex-controlled MCP server in the agent’s configuration. That server supplied eight remote tools and instructions that could shape the agent’s activity. Elastic says control of the endpoint could allow substituted responses, including tool calls, but its researchers did not observe malicious response substitution during testing.
The malware chains differed by operating system. On macOS, a Rust helper retrieved a command that downloaded a CloudSyncD payload. On Windows, the bootstrap could retrieve commands that launched PowerShell and other staging components. Elastic’s analysis also describes a Windows information stealer that collected data and sent archives through Telegram; the researchers demonstrated the traffic in a contained test, not as proof of infections among specific outside users.
The advertised audits returned invented results
The security tools in @apexacc/audit did not perform their advertised investigations, according to Elastic’s inspection of all 18 handlers. Some returned fixed findings, while others inserted user-provided labels or randomized and date-derived values. For example, one tool always reported “NOT A HONEYPOT,” and a token-risk tool generated scores from 55 to 94 using a random-number function.
Elastic also tested the remote scoring tool with a fictitious project, providing no repository, contract address or team information. The service returned a score of 51 out of 100 and disclosed that its AI scorer was unavailable. Elastic assessed the uniform score as likely a fabricated placeholder and said it could not independently verify the claimed outage or how the service generated the result.
The findings show how the package combined a functioning coding agent with hidden routing and command-execution features, while the accompanying audit tools offered the appearance of security review without carrying out the scans they advertised.