Fake Web3 accelerator spreads malware through npm packages

Elastic Security Labs said the campaign used the npm packages @apexacc/cli and @apexacc/audit to pose as a Web3 accelerator called Apex Accelerator. The researchers Jia Yu Chan and Daniel Stepanic said the packages were linked to the npm user apexaccelerator, the GitHub account apexaccs and the Apex Foundation.

The packages were no longer available when the report was written, but SafeDep had already connected three other npm packages to the same operation in July 2026. Those packages were said to have distributed a macOS stealer from the Atomic Stealer family.

Elastic said the campaign used social posts and in-person events to approach cryptocurrency wallet and market-intelligence developers with investment offers and instructions to run the CLI tool. Internet Archive snapshots from 19 March 2026 showed the Apex Foundation claiming $235,000 investments, grants and partnerships and saying it would connect projects with investors if they did not meet its criteria.

On Windows, the infection chain led to a stealer that gathered system data, clipboard text, browser and wallet information and sent it through Telegram. On macOS, the package deployed CloudSyncD, which first asked for the user's login password and then used it to run further payloads with sudo privileges.

Elastic said the packages could also intercept and redirect OpenRouter traffic and register an MCP server controlled by the attacker in the victim's agent settings. The researchers said this would let the attacker receive prompts, chat history, code snippets and tool outputs, and could shape later model actions.