Apex Accelerator's fake audits deliver malware through npm tools
Two Apex npm tools fetch executables and attacker-selected commands; one also sends coding-agent conversations to an Apex server. Find the tools and revoke exposed secrets.
An npm tool pitched as a Web3 security auditor gave its users fabricated findings and a route to malware. Elastic Security Labs’ investigation traces two Apex Accelerator packages, @apexacc/cli and @apexacc/audit, from their launchers to attacker-selected commands on Windows and macOS. Crypto founders and developers who ran those tools are the immediate audience for an exposure check. The coding assistant also routed model conversations, including a local file-read result in Elastic’s test, to an Apex-controlled server.
The fake accelerator had spent months building a public presence around free AI credits, coding tools and smart-contract audits. Its website claimed more than 200 portfolio projects and over $124 million raised. Its coding agent copied genuine Oh My Pi code, which helped the offer look plausible. Elastic compared the source and found 1,351 of 1,363 files in the agent directory matched the original; its preliminary inspection found no extra malicious behavior in the copied native utility. Apex added command-fetching and model-rerouting code around that working agent.
npm launchers fetch Apex binaries
The packages advertise different jobs. @apexacc/cli presents a coding assistant; @apexacc/audit presents an MCP audit server with 18 security tools. Their command entries, apex.cjs and audit.cjs, download platform-specific executables from project releases, cache them under the user’s home directory and start them when someone invokes the commands or uses npx. Installing a dependency and running its command are separate events, so inventory both installed packages and command execution.
The application bootstrap in each tool also requests an attacker-selected command from vrf[.]apexaccs[.]org. On Windows it writes a PowerShell script and a VBScript launcher under %TEMP%, then starts the latter through wscript.exe. Look for _apex_run.ps1 and _apex_run.vbs from the coding assistant, or _audit_run.ps1 and _audit_run.vbs from the audit tool. On Windows 11, the audit bootstrap additionally requests elevation to exclude %USERPROFILE%\.apex-audit from Microsoft Defender scanning and attempts to disable Smart App Control by setting VerifiedAndReputablePolicyState to zero. Check the host’s actual protection state alongside requests to the Windows delivery hosts 0auth-chromium[.]com and ehegisnightmare[.]icu.
On macOS the command request runs through package-specific Rust verifiers, apex-verify-darwin or apex-audit-verify-darwin. Elastic traced a fetched installer archive from verify[.]apexfdn[.]xyz to CloudSyncD, whose first stage prompts for an administrator password and stores it at ~/.config/cloudsync/data.json; its payload sends host details to ccmihr[.]com and accepts tasks. During Elastic’s analysis that server supplied no additional payloads. A machine with the password store or CloudSyncD installation warrants credential rotation and endpoint investigation, even if no later task is visible.
Agent conversations reach Apex servers
The coding assistant keeps an OpenRouter provider label while its bootstrap overwrites OPENROUTER_BASE_URL with the Apex endpoint at arena[.]apexaccs[.]org/api/llm/v1. It also replaces OPENROUTER_API_KEY with an Apex token and sets PI_OPENROUTER_RESPONSES to 0. In Elastic’s instrumented session, the resulting chat request reached arena[.]apexaccs[.]org/api/llm/v1/chat/completions. After the agent read a test file, the next request included that file’s contents as a tool result. Model traffic can therefore carry source code, prompts and local data to the operator of that endpoint during normal use.
The bootstrap also writes an apex-copilot entry to ~/.apex/agent/mcp.json, registering an Apex-controlled MCP server that survives process restarts. In Elastic’s capture, the server’s eight tool definitions appeared in outgoing model requests. The server controls those tool descriptions and instructions, giving its operator influence over later agent choices; in the instrumented session, a locally read file result entered an outgoing model request to the Apex endpoint. Start with outbound chat requests to arena[.]apexaccs[.]org and the persisted apex-copilot entry; the copied agent may still appear to work normally. Removing the npm package alone leaves the MCP registration and any exposed tokens to address.
Audit results were manufactured
Elastic tested the remote apex_score function on a made-up project with no repository or contract address. It returned 51/100 for the overall result and all five categories while saying its AI scorer was unavailable. In the separate local audit package, source inspection found that all 18 published handlers produced hard-coded, input-formatted, date-derived or randomized output in place of the advertised investigations. Elastic puts it plainly: “All 18 tools in @apexacc/audit return fabricated findings.” Rerun any contract or security checks previously based on Apex audit results with a trusted tool.
Elastic also analyzed a Windows stealer chain that collects browser credentials and cookies, screenshots and AI-client configuration files, including %APPDATA%\Claude\config.json, %APPDATA%\Cursor\User\storage.json, %APPDATA%\Cursor\User\settings.json, %APPDATA%\Windsurf\.env and %APPDATA%\Windsurf\auth.json. The analyzed initial Python loader stopped with a missing-dependency error in Elastic’s test; the later stages were recovered and examined, with contained stealer execution showing Telegram exfiltration. Treat a downloaded loader, executed stealer and stolen data as different findings when reconstructing a particular host.
Remove the tools and trace exposure
Search developer workstations, build runners and project package records for @apexacc/cli and @apexacc/audit. Check execution history for their launchers and the Windows script names, and correlate DNS or proxy records for vrf[.]apexaccs[.]org, arena[.]apexaccs[.]org and ccmihr[.]com. On Windows, %APPDATA%\.cobra is a useful lead, but the first-stage loader and the stealer both use it; its presence alone cannot tell you which stage ran. On macOS, review ~/.config/cloudsync/data.json, ~/.local/share/cloudsync/ and the cloudsyncd process or daemon alongside outbound connections.
Isolate hosts that ran an Apex executable. Remove the Apex tools and their persisted apex-copilot MCP entry, block the named endpoints, and recheck the effective LLM base URL in the agent process. For a host that ran the tools, investigate credentials, browser sessions and AI-client tokens exposed to the relevant platform chain; rotate or revoke those secrets from a clean machine. Validate any decisions previously based on Apex audit output using independent tools. A clean verification pass finds no Apex package command, MCP registration or Apex model endpoint on the recovered machine, while credential and session revocation deals with what may already have left it.