Elastic Security Labs said a group posing as a Web3 accelerator called Apex used two npm packages, @apexacc/cli and @apexacc/audit, to spread malware. It offered crypto start-ups free AI credits, coding tools and security audits. Elastic says the cli package copies an open-source coding agent, Oh My Pi: 1,351 of 1,363 files matched the original. Added code keeps the "OpenRouter" label but sends model requests to Apex servers. It also saves an Apex-run MCP server, a feed of tools and instructions for AI agents, in the agent's settings, where it persists across restarts.
Elastic says a test showed chat requests, including a file the agent had read, reached Apex's server. It did not see Apex swap in false model replies. Elastic also says the tools deliver malware for Macs and Windows PCs. All 18 tools in the audit package return made-up findings, it says. The findings do not say how many people installed the packages or who runs the group.
An AI coding agent is a new trust boundary: it handles prompts and code, and a stranger's server can feed it instructions. Security leads can ask which agents and npm packages are approved, who watches model endpoints and MCP settings, and how free-credit or audit offers are vetted.