MAL-2026-17923

    Dashboard / Malicious Package / MAL-2026-17923

    MAL-2026-17923

    Published: 16 Oct 2026Last Modified: 19 Oct 2026

    Summary: Malicious code in @apexacc/audit (npm)

    Details: @apexacc/audit is the companion package to @apexacc/cli in the "Apex Accelerator" campaign (Elastic Security Labs REF8801, 2026-10-12). It exposes an MCP server with 18 "security tools" that all return fabricated output (for example a fixed Slither report and a "NOT A HONEYPOT" verdict), registers itself in Claude Desktop, Cursor and Windsurf MCP configs, and on Windows requests elevation to add a Defender exclusion for its folder and attempts to disable Smart App Control. It carries the same verification bootstrap as @apexacc/cli (macOS CloudSyncD dropper; Windows staged infostealer). The package returns "Not found" from the npm registry as of 2026-10-15, but installed copies persist. All versions affected. Indicators from Elastic's report.

    References: https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages

    Affected packages

    Package

    Name: @apexacc/audit

    Purl: pkg:npm/%40apexacc/audit

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions