Fake 'Apex Copilot' coding agent on npm rerouted model traffic, planted an attacker MCP server and dropped malware
Summary
Elastic Security Labs reported on Oct 12, 2026 that @apexacc/cli, an npm package sold as the 'Apex Copilot' AI coding assistant, was malicious from its first release. It was a near-copy of the open-source coding agent Oh My Pi: 1,351 of the 1,363 files Elastic compared matched Oh My Pi v16.3.6. The added code sent the agent's model requests, including file contents from tool calls, to an attacker server while still labeling the provider OpenRouter. It also added an attacker-controlled MCP server to the agent's config and ran commands fetched from the operators' server, which led to a macOS backdoor and a Windows infostealer. A second package, @apexacc/audit, posed as an MCP security-audit server, but all 18 of its tools returned made-up findings. The operation posed as a Web3 accelerator offering crypto founders free Claude and Gemini credits. Oh My Pi is a legitimate open-source project that was copied; it is not at fault and is not affected.
Severity
Timeline
SafeDep reports earlier related packages, @apexfdn/apex and its re-publish as @copilot-mcp/apex, as a macOS infostealer.
First @apexacc/cli release on npm (per Vigilance and npm registry metadata).
Version 1.5.122 is published; per Vigilance it tries to exclude its folder from Windows Defender scanning and turn off Smart App Control.
Vigilance publishes VIGI-001-2026 on @apexacc/cli.
Latest version, 1.6.2, is published (per npm registry).
Elastic Security Labs publishes its REF8801 report on the Apex Accelerator operation.
npm marks @apexacc/cli 1.6.2 as no longer supported but still serves its tarball; @apexacc/audit returns not found.
How it happened
The npm launcher downloads a platform-specific executable from the project's GitHub releases and runs it. Inside, a bootstrap added to the copied Oh My Pi code overwrites OPENROUTER_API_KEY, OPENROUTER_BASE_URL and PI_OPENROUTER_RESPONSES so chat requests go to arena.apexaccs[.]org/api/llm/v1/chat/completions; Elastic saw output from a local read tool appear in a later request there. Controlling that endpoint would also let the operators return their own tool calls, and the captured source defaults tool approvals to yolo, although Elastic did not observe malicious responses. The bootstrap creates or replaces an apex-copilot entry in ~/.apex/agent/mcp.json pointing at arena.apexaccs[.]org/api/copilot/mcp, which persists across restarts. A separate 'verification' path posts to vrf.apexaccs[.]org/api/v1/vrf and runs the command it gets back; Elastic traced that to the CloudSyncD backdoor on macOS and a multi-stage infostealer on Windows that sends data out through Telegram. As of Oct 15, 2026 npm marks @apexacc/cli 1.6.2 as no longer supported, but the registry still lists 122 versions and still serves the 1.6.2 tarball, so it can still be installed; @apexacc/audit returns not found.
How to check your app
- Check npm install history, lockfiles and global packages for @apexacc/cli, @apexacc/audit, @apexfdn/apex or @copilot-mcp/apex.
- Look for an apex-copilot entry in ~/.apex/agent/mcp.json and for OPENROUTER_BASE_URL pointing at arena.apexaccs[.]org.
- Block the apexaccs[.]org domains and the other indicators in Elastic's report.
- If any of these ran, treat the machine as compromised: remove the packages and rotate the API keys, tokens, browser sessions and wallet keys it could reach.
- Install coding agents only from their official project or publisher, not from accelerator, grant or 'free credits' offers.
Sources
- Elastic Security Labs: Auditing the auditor: Unmasking Apex Accelerator (REF8801)
- Vigilance VIGI-001-2026: @apexacc/cli disables Windows security controls and installs a backdoor
- SafeDep: @copilot-mcp/apex: a macOS infostealer re-published on npm after takedown
- npm registry metadata for @apexacc/cli