One Operation, Three npm Accounts, Four Mutations: How the Apex Accelerator Malware Evolved Before Elastic Caught It
The Apex Accelerator operation that Elastic Security Labs exposed on October 12 did not start with the package Elastic named. Reading its npm packages and their full version history without running them, we can date the same operation through three npm accounts, three package names and four distinct changes in what the code does, from an AI-agent tool in April to a Windows defense-evasion launcher in September. It stopped shipping the day npm acted. All three packages are blocked by our package check and filed with OpenSSF.
What Elastic found, and what this adds
Elastic Security Labs (Jia Yu Chan and Daniel Stepanic) published REF8801 on October 12: a fake Web3 accelerator that courted crypto founders with free AI credits and shipped @apexacc/cli, a repackaged coding agent that redirects the developer's model traffic to attacker infrastructure, persists an attacker-controlled MCP server and drops credential stealers on macOS and Windows. Read Elastic's report first. Everything below rests on it.
Elastic analyzed version 1.6.1 and traced the bootstrap to the earliest preserved version. We read every published version of @apexacc/cli and the latest version of the other two, plus the registry history of all three. What we add is the order of events: which package came first, what changed in each step, and when.
By npm's counts through October 16, @apexfdn/copilot-mcp was downloaded 6,105 times and @apexscore/cli 6,736 times. Download counts include mirrors and automated installs, so they are an upper bound on people, not a count of victims.
Why we call it one operation
Three links tie the packages together. The first two share a contact domain, apexfdn.xyz: @apexfdn/copilot-mcp lists contact@ and @apexscore/cli lists support@ at it. The second and third build from the same GitHub repository, Apex-Accelerator/apexcli. And all three point their users at hosts that appear in Elastic's REF8801 indicators: arena.apexfdn.xyz, then arena.apexaccs.org. We say "operation" rather than "actor" on purpose. Shared infrastructure ties the packages together; it does not prove one person typed them.
The four mutations
1. It started by recruiting the AI agent. @apexfdn/copilot-mcp shipped 21 versions between April 30 and July 20. It is an MCP server that offers "Web3 diligence" tools and sends project descriptions and smart-contract source to the operation's server. After enough requests, the server answers with a "verify required" error carrying an operating-system-specific shell command, and the tool's own description tells the AI agent that it can run that command itself if it has shell access. The command never ships in the package, so a scanner reading the package sees clean code. The malicious step lives in a server response, addressed to the agent.
2. Then it learned to avoid the AI agent. @apexscore/cli shipped 33 versions between July 30 and August 9 under a second account. Its launcher downloads a roughly 150 MB binary from the operation's GitHub releases and runs it. Its integrity check fetches the expected hash from the same release, so it verifies nothing. In its latest version sits an install script, wired to nothing, that exits quietly when it sees Claude Code, Cursor, Windsurf or an Anthropic or OpenAI key in the environment. A security team that detonates packages inside an AI coding tool would see the harmless path.
3. It moved its infrastructure and its name. On August 9, @apexscore/cli's last version moved its homepage from arena.apexfdn.xyz to arena.apexaccs.org, and the same day a third account created @apexacc/cli, the package Elastic later named. By October 16 it had 22,056 downloads, by npm's own count.
4. It escalated, and broke itself doing it. On September 17, version 1.5.120 added a command to turn off Windows Smart App Control, and 1.5.121 added a Windows Defender exclusion for its own folder. Both worked only if the user was already an administrator. The same day, 1.5.122 added a UAC prompt to get elevation, and in the same change wrapped both commands in a JavaScript template literal with single backslashes, which mangles the Windows paths. From then on the prompt still appeared, but both commands most likely failed. On September 27, version 1.6.2 added a change to the user's PowerShell execution policy, which needs no elevation at all. Our earlier post on the backslash bug has the detail.
Elastic published on October 12. npm deprecated @apexacc/cli on October 13. There has been no new version and no new package name since.
What this tells a defender
The order is the lesson. The operation first tried to make AI agents do its work, then tried to hide from them, then went after the developer's Windows machine directly. Each step was small and tested in public, on npm, where anyone could read it. A one-version snapshot shows one technique. The sequence shows where the next package is likely to aim.
Two practical takeaways. Treat any MCP tool that asks the agent to run a command taken from a tool result as hostile, whatever the package code looks like. And do not rely on detonating a suspicious package inside an AI coding tool: at least one of these was written to behave differently there.
What we hold, and what we don't
All three packages are on our deny-list and blocked by check-package: @apexacc/cli since October 16, @apexscore/cli and @apexfdn/copilot-mcp since October 17. We filed them with OpenSSF's malicious-packages database, pull requests 1644 and 1647. Neither is merged yet.
What we do not have is a sighting of this operation's infrastructure from our own sensors. None of its hosts appears in our edge blocks or honeypot canaries. Our evidence is the published code, read statically, and the registry's own timestamps. The second-stage binaries were not examined, and we did not fetch them.
We checked each dated claim in this post against the npm registry and our earlier reads before publishing. At least 5% of what remains is still wrong, and we don't know which.
If this was useful, or if it wasn't, rate it at the bottom of the page. It is the only direct signal we get.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=one-operation-three-npm-accounts-four-mutations-how-the-apex-accelerator-malware-evolved-before-e
Comments