Skip to content
Malicious npm Packages from Fake Web3 Accelerator Target Cryptocurrency Startups

Malicious npm Packages from Fake Web3 Accelerator Target Cryptocurrency Startups

First seen 19 Oct 2026, 13:49 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 19, 2026 at 14:52 UTC
  • •Apex Accelerator uses fake Web3 services to distribute malware via npm packages.
  • •The malicious packages target both Windows and macOS systems with information stealers.
  • •The operation has connections to a Russian-language background, but the identity remains unclear.

A fake Web3 accelerator named Apex Accelerator has been distributing malware via malicious npm packages, specifically targeting cryptocurrency startups. The operation has been linked to information-stealing malware and backdoors for both Windows and macOS systems. Researchers from Elastic Security Labs identified the npm packages '@apexacc/cli' and '@apexacc/audit', which were designed to masquerade as legitimate tools offering AI credits and security audits. The packages were published by a user named 'apexaccelerator' and were connected to a GitHub account and an entity called the Apex Foundation. Although the packages have been removed, the operation's origins remain unclear, with some evidence suggesting a Russian-language background. The Apex Foundation has been active since at least April 2026, promoting its services to cryptocurrency developers. This campaign is an extension of previous operations that also delivered malware through similar means.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-07-01
Previous npm packages linked to Apex Accelerator identified
SafeDep reported three npm packages distributing macOS malware related to the same operation.
The Hacker News
2026-10-19
Apex Accelerator operation disclosed
Elastic Security Labs published findings on the malicious npm packages and their impact on cryptocurrency startups.
Elastic Security Labs

More articles in this cluster (3)

Following this threat?

Track Atomic Stealer in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (16)

1 / 3

Common questions

What systems are affected?
Both Windows and macOS systems are targeted by the malware delivered through the malicious npm packages.
What should developers do to protect themselves?
Developers should avoid using npm packages from unverified sources and monitor for any suspicious activity related to their projects.
Is there a known threat actor behind this operation?
The identity of the threat actor remains unclear, but there are indications of a Russian-language background in the code.