Fake Web3 accelerator spread malware via npm packages and hijacked AI agent traffic
Elastic Security Labs researchers uncovered a campaign posing as a Web3 business accelerator called Apex Accelerator, offering supposedly free AI credits for Anthropic's Claude and Google's Gemini through two npm packages, '@apexacc/cli' and '@apexacc/audit'. The first package posed as an AI advisor for Web3 founders and the second as a smart-contract security-audit tool, but both actually installed information-stealing malware and backdoors on Windows and macOS. The 'AI advisor' tool was in fact a legitimate coding agent repackaged to route its requests through attacker-controlled servers, while the audit tool generated entirely fabricated security findings to appear credible. The packages and their GitHub repositories have since been taken down, and while the identity behind the operation remains unknown, researchers found Russian-language comments in the code's commit history. For a business evaluating ready-made AI tools from public repositories like npm, the case shows that even a tool marketed as a security scanner can itself be the threat, making provenance checks necessary before installation.
Sources
This summary was written automatically with AI from the public sources listed above and checked by an independent AI reviewer before publication. For full details, read the original source.