{"id":"MAL-2026-17923","summary":"Malicious code in @apexacc/audit (npm)","details":"@apexacc/audit is the companion package to @apexacc/cli in the \"Apex Accelerator\" campaign (Elastic Security Labs REF8801, 2026-10-12). It exposes an MCP server with 18 \"security tools\" that all return fabricated output (for example a fixed Slither report and a \"NOT A HONEYPOT\" verdict), registers itself in Claude Desktop, Cursor and Windsurf MCP configs, and on Windows requests elevation to add a Defender exclusion for its folder and attempts to disable Smart App Control. It carries the same verification bootstrap as @apexacc/cli (macOS CloudSyncD dropper; Windows staged infostealer). The package returns \"Not found\" from the npm registry as of 2026-10-15, but installed copies persist. All versions affected. Indicators from Elastic's report.","modified":"2026-10-19T00:45:04.809245103Z","published":"2026-10-16T00:00:00Z","database_specific":{"iocs":{"domains":["apexaccs.org","arena.apexaccs.org","token.apexaccs.org","vrf.apexaccs.org","arena.apexfdn.xyz","verify.apexfdn.xyz","ccmihr.com","0auth-chromium.com","ehegisnightmare.icu","arenapex.cloud","cloudmain365duo.top","fdn4apex.com","main.router-apex.com","update.apex-arena-router.com"],"files":[{"source":"DROPPED","digests":{"sha256":"5ee7145061f05779f7f6f9b72e216713d17d53e183a92f408bfbbc44f2bfb95d"},"note":"Windows Bun executable containing the audit application and verification bootstrap (Elastic Security Labs REF8801)","paths":["apex-audit-windows-x64.exe"]},{"source":"DROPPED","digests":{"sha256":"20f0a401676292d4ae34932e61f34afa97bcfc47ee517cda2afeb7222264a193"},"note":"macOS ARM64 Bun executable (Elastic Security Labs REF8801)","paths":["apex-audit-darwin-arm64"]},{"note":"macOS Rust executable that retrieves and launches verification commands (Elastic Security Labs REF8801)","paths":["apex-audit-verify-darwin"],"source":"DROPPED","digests":{"sha256":"a50cdb508d13884630945a98eea0615b866d938eb0a16c5d958e6c8c181a6df8"}},{"paths":["installer"],"source":"DROPPED","digests":{"sha256":"68f5a00eafa8ecebf5d93328e0fec23b24d6f91808c8384db002946a13656c71"},"note":"CloudSyncD macOS dropper (Elastic Security Labs REF8801)"},{"digests":{"sha256":"ee8cd9aba420f1b26b5d43e5bcdd6025a277b4946bb5daf76ab45c0e5f7ecd0b"},"note":"Python second-stage loader (Elastic Security Labs REF8801)","paths":["exegis.exe"],"source":"DROPPED"},{"digests":{"sha256":"ed5cb4af1d2cb067b8d23783ebf05d70278728462ba4f1bf29da0a3a41efc35e"},"note":"Encrypted third stage, decrypted by the second-stage Python loader (Elastic Security Labs REF8801)","paths":["enc_loader.exe"],"source":"DROPPED"}]}},"references":[{"type":"REPORT","url":"https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages"}],"affected":[{"package":{"name":"@apexacc/audit","ecosystem":"npm","purl":"pkg:npm/%40apexacc/audit"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@apexacc/audit/MAL-2026-17923.json"}}],"schema_version":"1.9.0","credits":[{"name":"Elastic Security Labs (Jia Yu Chan, Daniel Stepanic)","contact":["https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages"],"type":"FINDER"},{"name":"Patrick Duggan, DugganUSA","contact":["mailto:patrick@dugganusa.com"],"type":"REPORTER"}]}