Apex Accelerator: a fake npm coding agent plants an attacker MCP server

01What happened

Elastic Security Labs published its analysis of Apex Accelerator on October 12, 2026, tracking the operation as REF8801. Jia Yu Chan and Daniel Stepanic examined two npm packages, @apexacc/cli and @apexacc/audit, published by a group posing as a Web3 venture accelerator. Elastic's supply-chain monitor flagged the CLI, which the researchers say was malicious from the moment it was published.

02How it works

The CLI is a near-complete copy of Oh My Pi, an open-source terminal coding agent: 1,351 of the 1,363 files compared in Apex Copilot v1.6.1 match Oh My Pi v16.3.6 exactly. The added bootstrap overwrites three environment variables so model requests reach an attacker endpoint while the provider still reads as OpenRouter, and Elastic saw local file contents from a read tool call appear in a later request there. The bootstrap also writes an apex-copilot entry into the agent's MCP config, pointing at an attacker server that supplies its own tool definitions and instructions. Both packages then download platform-specific executables.

03Who is affected

Developers who installed @apexacc/cli or @apexacc/audit, which the operation promoted to crypto founders and startups with offers of free AI credits, coding tools and security audits. Elastic publishes no install or victim counts. On Windows the stealer also reads AI client configuration files for Claude, Cursor and Windsurf, alongside browser, wallet and remote-access data.

04What to do

Treat any host that ran either package as compromised and rotate the credentials it held, because Elastic documents wallet and browser credential theft. Check the agent MCP config for an apex-copilot entry and the environment for overwritten OPENROUTER_API_KEY and OPENROUTER_BASE_URL values. Elastic lists the campaign's indicators and its endpoint behavior rules in the report.

Questions people ask

How do I check whether the Apex packages touched my machine?

Three places show the changes Elastic documented: the agent MCP config at ~/.apex/agent/mcp.json, which gains an apex-copilot entry pointing at arena.apexaccs[.]org; the environment, where the bootstrap overwrites OPENROUTER_API_KEY, OPENROUTER_BASE_URL and PI_OPENROUTER_RESPONSES; and npm install records naming @apexacc/cli or @apexacc/audit. Elastic also publishes an indicators table in the report.

Is the Apex Audit MCP server a real security scanner?

Apex Audit performs no real analysis. Elastic found that all 18 tool handlers return fabricated output built from hard-coded text, user-supplied labels, random values or values derived from the date. The audit_full_contract tool claims a Slither v0.10.4 run over 847 lines, audit_honeypot always answers NOT A HONEYPOT, and audit_token_risk returns random scores between 55 and 94.

Did Apex Accelerator tamper with the answers the coding agent gave?

Elastic reports that it did not observe malicious substitution of model responses, while noting that the captured defaults would permit it. What Elastic did observe is collection: prompts, conversation history, code and tool output pass through the attacker endpoint, and the researchers saw contents from a local read tool call appear in a later request to that service.

How does Apex Accelerator relate to the earlier Apex npm packages?

Elastic's report links to earlier SafeDep research on Apex-branded npm packages. SafeDep's Kunal Singh documented @apexfdn/apex on July 22, 2026, a postinstall dropper that npm removed after 34 versions and that the operator republished as @copilot-mcp/apex about eleven hours later. The October packages carry different names and a different payload set.

Sources 4 links, all fetched

1. 1elastic.coElastic Security Labs
2. 2github.comOh My Pi Repo
3. 3safedep.ioSafeDep July Report
4. 4jamf.comJamf On CloudSyncD