Malicious code in @apexacc/audit (npm)

{
  "id": "62e4fb92857c673661d351f6ea1ef66f303947b2e44c5fedfb4c0ee94ded8d9c",
  "url": "https://osv.dev/vulnerability/MAL-2026-17923",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in @apexacc/audit (npm)",
    "summary": "@apexacc/audit is the companion package to @apexacc/cli in the \"Apex Accelerator\" campaign (Elastic Security Labs REF8801, 2026-10-12). It exposes an MCP server with 18 \"security tools\" that all return fabricated output (for example a fixed Slither report and a \"NOT A HONEYPOT\" verdict), registers itself in Claude Desktop, Cursor and Windsurf MCP configs, and on Windows requests elevation to add a Defender exclusion for its folder and attempts to disable Smart App Control. It carries the same verification bootstrap as @apexacc/cli (macOS CloudSyncD dropper; Windows staged infostealer). The package returns \"Not found\" from the npm registry as of 2026-10-15, but installed copies persist. All versions affected. Indicators from Elastic's report.",
    "evidence": "osv:MAL-2026-17923",
    "products": [
      {
        "name": {
          "value": "@apexacc/audit",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17923",
      "aliases": [
        "MAL-2026-17923"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "@apexacc/audit",
            "purl": "pkg:npm/%40apexacc/audit",
            "ecosystem": "npm"
          },
          "database_specific": {
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@apexacc/audit/MAL-2026-17923.json"
          }
        }
      ],
      "modified": "2026-10-19T00:45:04.809245103Z",
      "provider": "osv",
      "references": [
        "https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages"
      ],
      "provider_metadata": {
        "iocs": {
          "files": [
            {
              "note": "Windows Bun executable containing the audit application and verification bootstrap (Elastic Security Labs REF8801)",
              "paths": [
                "apex-audit-windows-x64.exe"
              ],
              "source": "DROPPED",
              "digests": {
                "sha256": "5ee7145061f05779f7f6f9b72e216713d17d53e183a92f408bfbbc44f2bfb95d"
              }
            },
            {
              "note": "macOS ARM64 Bun executable (Elastic Security Labs REF8801)",
              "paths": [
                "apex-audit-darwin-arm64"
              ],
              "source": "DROPPED",
              "digests": {
                "sha256": "20f0a401676292d4ae34932e61f34afa97bcfc47ee517cda2afeb7222264a193"
              }
            },
            {
              "note": "macOS Rust executable that retrieves and launches verification commands (Elastic Security Labs REF8801)",
              "paths": [
                "apex-audit-verify-darwin"
              ],
              "source": "DROPPED",
              "digests": {
                "sha256": "a50cdb508d13884630945a98eea0615b866d938eb0a16c5d958e6c8c181a6df8"
              }
            },
            {
              "note": "CloudSyncD macOS dropper (Elastic Security Labs REF8801)",
              "paths": [
                "installer"
              ],
              "source": "DROPPED",
              "digests": {
                "sha256": "68f5a00eafa8ecebf5d93328e0fec23b24d6f91808c8384db002946a13656c71"
              }
            },
            {
              "note": "Python second-stage loader (Elastic Security Labs REF8801)",
              "paths": [
                "exegis.exe"
              ],
              "source": "DROPPED",
              "digests": {
                "sha256": "ee8cd9aba420f1b26b5d43e5bcdd6025a277b4946bb5daf76ab45c0e5f7ecd0b"
              }
            },
            {
              "note": "Encrypted third stage, decrypted by the second-stage Python loader (Elastic Security Labs REF8801)",
              "paths": [
                "enc_loader.exe"
              ],
              "source": "DROPPED",
              "digests": {
                "sha256": "ed5cb4af1d2cb067b8d23783ebf05d70278728462ba4f1bf29da0a3a41efc35e"
              }
            }
          ],
          "domains": [
            "apexaccs.org",
            "arena.apexaccs.org",
            "token.apexaccs.org",
            "vrf.apexaccs.org",
            "arena.apexfdn.xyz",
            "verify.apexfdn.xyz",
            "ccmihr.com",
            "0auth-chromium.com",
            "ehegisnightmare.icu",
            "arenapex.cloud",
            "cloudmain365duo.top",
            "fdn4apex.com",
            "main.router-apex.com",
            "update.apex-arena-router.com"
          ]
        }
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 372194,
  "published_at": "2026-10-16T00:00:00+00:00"
}