MAL-2026-17923

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@apexacc/audit/MAL-2026-17923.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17923
Published
2026-10-16T00:00:00Z
Modified
2026-10-19T00:45:04Z
Summary
Malicious code in @apexacc/audit (npm)
Details

@apexacc/audit is the companion package to @apexacc/cli in the "Apex Accelerator" campaign (Elastic Security Labs REF8801, 2026-10-12). It exposes an MCP server with 18 "security tools" that all return fabricated output (for example a fixed Slither report and a "NOT A HONEYPOT" verdict), registers itself in Claude Desktop, Cursor and Windsurf MCP configs, and on Windows requests elevation to add a Defender exclusion for its folder and attempts to disable Smart App Control. It carries the same verification bootstrap as @apexacc/cli (macOS CloudSyncD dropper; Windows staged infostealer). The package returns "Not found" from the npm registry as of 2026-10-15, but installed copies persist. All versions affected. Indicators from Elastic's report.

Database specific 
{
    "iocs":  {
        "domains":  [
            "apexaccs.org",
            "arena.apexaccs.org",
            "token.apexaccs.org",
            "vrf.apexaccs.org",
            "arena.apexfdn.xyz",
            "verify.apexfdn.xyz",
            "ccmihr.com",
            "0auth-chromium.com",
            "ehegisnightmare.icu",
            "arenapex.cloud",
            "cloudmain365duo.top",
            "fdn4apex.com",
            "main.router-apex.com",
            "update.apex-arena-router.com"
        ],
        "files":  [
            {
                "digests":  {
                    "sha256":  "5ee7145061f05779f7f6f9b72e216713d17d53e183a92f408bfbbc44f2bfb95d"
                },
                "note":  "Windows Bun executable containing the audit application and verification bootstrap (Elastic Security Labs REF8801)",
                "paths":  [
                    "apex-audit-windows-x64.exe"
                ],
                "source":  "DROPPED"
            },
            {
                "digests":  {
                    "sha256":  "20f0a401676292d4ae34932e61f34afa97bcfc47ee517cda2afeb7222264a193"
                },
                "note":  "macOS ARM64 Bun executable (Elastic Security Labs REF8801)",
                "paths":  [
                    "apex-audit-darwin-arm64"
                ],
                "source":  "DROPPED"
            },
            {
                "digests":  {
                    "sha256":  "a50cdb508d13884630945a98eea0615b866d938eb0a16c5d958e6c8c181a6df8"
                },
                "note":  "macOS Rust executable that retrieves and launches verification commands (Elastic Security Labs REF8801)",
                "paths":  [
                    "apex-audit-verify-darwin"
                ],
                "source":  "DROPPED"
            },
            {
                "digests":  {
                    "sha256":  "68f5a00eafa8ecebf5d93328e0fec23b24d6f91808c8384db002946a13656c71"
                },
                "note":  "CloudSyncD macOS dropper (Elastic Security Labs REF8801)",
                "paths":  [
                    "installer"
                ],
                "source":  "DROPPED"
            },
            {
                "digests":  {
                    "sha256":  "ee8cd9aba420f1b26b5d43e5bcdd6025a277b4946bb5daf76ab45c0e5f7ecd0b"
                },
                "note":  "Python second-stage loader (Elastic Security Labs REF8801)",
                "paths":  [
                    "exegis.exe"
                ],
                "source":  "DROPPED"
            },
            {
                "digests":  {
                    "sha256":  "ed5cb4af1d2cb067b8d23783ebf05d70278728462ba4f1bf29da0a3a41efc35e"
                },
                "note":  "Encrypted third stage, decrypted by the second-stage Python loader (Elastic Security Labs REF8801)",
                "paths":  [
                    "enc_loader.exe"
                ],
                "source":  "DROPPED"
            }
        ]
    }
}
References
Credits

Affected packages

npm / @apexacc/audit

Package

Name
@apexacc/audit
View open source insights on deps.dev
Purl
pkg:npm/%40apexacc/audit

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@apexacc/audit/MAL-2026-17923.json"