Elastic exposes npm packages that posed as a Web3 accelerator and delivered malware
Elastic Security Labs documents an operation posing as a Web3 accelerator that delivered malware to macOS and Windows through npm packages and produced fabricated security findings from its audit tools.
Source: Auditando o auditor: desmascarando o Apex Accelerator (elastic.co). Text prepared with AI from this source.
What happened and what to do
Elastic Security Labs identified the malicious npm package @apexacc/cli, linked to an operation posing as a Web3 accelerator called Apex, whose website claims more than 200 portfolio projects. The group targeted crypto startups and founders with free AI credits, programming tools and security audits, and announced an in-person event through a dedicated invitation page. The campaigns delivered the CloudSyncD malware for macOS and an information stealer for Windows that exfiltrates data through Telegram. A legitimate programming agent was repackaged to send model requests through services controlled by the attackers. All 18 tools in the @apexacc/audit package returned fabricated findings, and in a separate test the scoring service of @apexacc/cli returned 51/100 for a fictitious project, claiming its AI evaluator was unavailable.
For a company, this case calls for controls over the software supply chain and the development environment, not only content analysis. In practice, that means keeping lockfiles and pinned npm dependency versions, enforcing an allowlist of trusted publishers, and quarantining newly published packages before they reach builds. It also means monitoring outbound traffic from developer workstations and CI pipelines, alerting on calls to unregistered AI model endpoints, and setting a policy for programming agents that accepts only approved endpoints. Third-party audit tools should run in a sandbox, with their results validated by a second method before they inform any security decision.
How the consultancy can help
Diagnosis of exposure to npm packages, audit tools and programming agents of unverified origin in the development environment, followed by implementation of dependency controls, outbound traffic monitoring and agent policies, with ongoing operation under contract.
Next step
If your company uses npm packages, programming agents or third-party audit tools, send a short description of your case. We reply with a scoped proposal after an initial diagnosis.
Let's assess your project
I reply with scope and a proposal.