{"items":[{"id":"NVI-00008351","kind":"supply_chain_event","title":"Malicious code in @apexacc/cli (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-rm6v-hm93-vwf3"],"plain_summary":"GitHub lists this malware advisory for @apexacc/cli, @apexacc/cli, @apexacc/cli, @apexacc/cli, @apexacc/cli. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-059ddd0fed851a6b92353067a318f96b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-059ddd0fed851a6b92353067a318f96b","url":"https://github.com/advisories/GHSA-rm6v-hm93-vwf3","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-rm6v-hm93-vwf3","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:59.340Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-059ddd0fed851a6b92353067a318f96b"],"technology":"@apexacc/cli","known_exclusions":[],"conditions_summary":"@apexacc/cli is distributed by \"Apex Accelerator\" (Apex Arena), a fake Web3 accelerator that lures crypto founders with free AI credits and audits. Elastic Security Labs (REF8801, published 2026-10-12) found it is a repackaged Oh My Pi coding agent (1,351 of 1,363 files identical) with malicious additions that hijack the developer's AI coding agent: it overwrites OPENROUTER_BASE_URL so model traffic (prompts, files read, tool results) goes to attacker infrastructure at arena.apexaccs.org; persists an attacker-controlled remote MCP server in ~/.apex/agent/mcp.json; and defaults tool approval to \"yolo\". A bootstrap retrieves commands from vrf.apexaccs.org: on macOS it drops CloudSyncD (fake password prompt, credential theft, C2 ccmihr.com); on Windows a staged loader chain ends in an infostealer that exfiltrates browser credentials, wallets, messengers, VPN clients and Claude/Cursor/Windsurf configs over Telegram. Elastic analyzed version 1.6.1 and traced the bootstrap to the earliest preserved version (script host arenapex.cloud). The package was still live on npm (latest 1.6.2) with no OSV record as of 2026-10-16. Independently confirmed by static inspection of the live 1.6.2 npm t","public_affected_ranges":["> 0"]},{"certainty":"source_listed","source_ids":["sr-059ddd0fed851a6b92353067a318f96b"],"technology":"@apexacc/cli","known_exclusions":[],"conditions_summary":"@apexacc/cli is distributed by \"Apex Accelerator\" (Apex Arena), a fake Web3 accelerator that lures crypto founders with free AI credits and audits. Elastic Security Labs (REF8801, published 2026-10-12) found it is a repackaged Oh My Pi coding agent (1,351 of 1,363 files identical) with malicious additions that hijack the developer's AI coding agent: it overwrites OPENROUTER_BASE_URL so model traffic (prompts, files read, tool results) goes to attacker infrastructure at arena.apexaccs.org; persists an attacker-controlled remote MCP server in ~/.apex/agent/mcp.json; and defaults tool approval to \"yolo\". A bootstrap retrieves commands from vrf.apexaccs.org: on macOS it drops CloudSyncD (fake password prompt, credential theft, C2 ccmihr.com); on Windows a staged loader chain ends in an infostealer that exfiltrates browser credentials, wallets, messengers, VPN clients and Claude/Cursor/Windsurf configs over Telegram. Elastic analyzed version 1.6.1 and traced the bootstrap to the earliest preserved version (script host arenapex.cloud). The package was still live on npm (latest 1.6.2) with no OSV record as of 2026-10-16. Independently confirmed by static inspection of the live 1.6.2 npm t","public_affected_ranges":["= 1.5.121"]},{"certainty":"source_listed","source_ids":["sr-059ddd0fed851a6b92353067a318f96b"],"technology":"@apexacc/cli","known_exclusions":[],"conditions_summary":"@apexacc/cli is distributed by \"Apex Accelerator\" (Apex Arena), a fake Web3 accelerator that lures crypto founders with free AI credits and audits. Elastic Security Labs (REF8801, published 2026-10-12) found it is a repackaged Oh My Pi coding agent (1,351 of 1,363 files identical) with malicious additions that hijack the developer's AI coding agent: it overwrites OPENROUTER_BASE_URL so model traffic (prompts, files read, tool results) goes to attacker infrastructure at arena.apexaccs.org; persists an attacker-controlled remote MCP server in ~/.apex/agent/mcp.json; and defaults tool approval to \"yolo\". A bootstrap retrieves commands from vrf.apexaccs.org: on macOS it drops CloudSyncD (fake password prompt, credential theft, C2 ccmihr.com); on Windows a staged loader chain ends in an infostealer that exfiltrates browser credentials, wallets, messengers, VPN clients and Claude/Cursor/Windsurf configs over Telegram. Elastic analyzed version 1.6.1 and traced the bootstrap to the earliest preserved version (script host arenapex.cloud). The package was still live on npm (latest 1.6.2) with no OSV record as of 2026-10-16. Independently confirmed by static inspection of the live 1.6.2 npm t","public_affected_ranges":["= 1.6.0"]},{"certainty":"source_listed","source_ids":["sr-059ddd0fed851a6b92353067a318f96b"],"technology":"@apexacc/cli","known_exclusions":[],"conditions_summary":"@apexacc/cli is distributed by \"Apex Accelerator\" (Apex Arena), a fake Web3 accelerator that lures crypto founders with free AI credits and audits. Elastic Security Labs (REF8801, published 2026-10-12) found it is a repackaged Oh My Pi coding agent (1,351 of 1,363 files identical) with malicious additions that hijack the developer's AI coding agent: it overwrites OPENROUTER_BASE_URL so model traffic (prompts, files read, tool results) goes to attacker infrastructure at arena.apexaccs.org; persists an attacker-controlled remote MCP server in ~/.apex/agent/mcp.json; and defaults tool approval to \"yolo\". A bootstrap retrieves commands from vrf.apexaccs.org: on macOS it drops CloudSyncD (fake password prompt, credential theft, C2 ccmihr.com); on Windows a staged loader chain ends in an infostealer that exfiltrates browser credentials, wallets, messengers, VPN clients and Claude/Cursor/Windsurf configs over Telegram. Elastic analyzed version 1.6.1 and traced the bootstrap to the earliest preserved version (script host arenapex.cloud). The package was still live on npm (latest 1.6.2) with no OSV record as of 2026-10-16. Independently confirmed by static inspection of the live 1.6.2 npm t","public_affected_ranges":["= 1.6.2"]},{"certainty":"source_listed","source_ids":["sr-059ddd0fed851a6b92353067a318f96b"],"technology":"@apexacc/cli","known_exclusions":[],"conditions_summary":"@apexacc/cli is distributed by \"Apex Accelerator\" (Apex Arena), a fake Web3 accelerator that lures crypto founders with free AI credits and audits. Elastic Security Labs (REF8801, published 2026-10-12) found it is a repackaged Oh My Pi coding agent (1,351 of 1,363 files identical) with malicious additions that hijack the developer's AI coding agent: it overwrites OPENROUTER_BASE_URL so model traffic (prompts, files read, tool results) goes to attacker infrastructure at arena.apexaccs.org; persists an attacker-controlled remote MCP server in ~/.apex/agent/mcp.json; and defaults tool approval to \"yolo\". A bootstrap retrieves commands from vrf.apexaccs.org: on macOS it drops CloudSyncD (fake password prompt, credential theft, C2 ccmihr.com); on Windows a staged loader chain ends in an infostealer that exfiltrates browser credentials, wallets, messengers, VPN clients and Claude/Cursor/Windsurf configs over Telegram. Elastic analyzed version 1.6.1 and traced the bootstrap to the earliest preserved version (script host arenapex.cloud). The package was still live on npm (latest 1.6.2) with no OSV record as of 2026-10-16. Independently confirmed by static inspection of the live 1.6.2 npm t","public_affected_ranges":["= 1.5.122"]}],"null_published_at":"2026-10-31T22:13:22.841Z","source_updated_at":"2026-10-26T06:30:30.000Z","source_disclosed_at":"2026-10-19T03:31:11.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:56:59.340Z"}],"next_cursor":null,"snapshot_revision":"42594"}