A fake Web3 accelerator's npm tools rerouted a coding agent's model traffic and planted an MCP server

What happened

Elastic Security Labs reported that REF8801, posing as a Web3 investor called Apex Accelerator, steered crypto founders to two npm packages, @apexacc/cli and @apexacc/audit, that installed an information stealer on Windows and a backdoor on macOS. The CLI was a near-copy of the open-source Oh My Pi coding agent, with 1,351 of its 1,363 files matching, and its bootstrap sent OpenRouter model requests to an attacker endpoint and registered an attacker-controlled MCP server in the victim's agent configuration. The audit package, offered as an MCP server with 18 security tools, returned fabricated findings.

Why it matters

The stealer is ordinary; the agent wiring is new. Rerouted model traffic gives the operator every prompt, code snippet and tool output the agent sends, and the registered MCP server can add instructions to the agent's prompt from then on. Anyone who ran these packages should check the agent's model endpoint and MCP settings, not only clean the host.

Sources

1. elastic.co Auditing the auditor: Unmasking Apex Accelerator October 12, 2026
2. The Hacker News Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic October 19, 2026