Fake "Apex Accelerator" npm Packages Reroute a Coding Agent's LLM Traffic and Register an Attacker MCP Server

Web3 developers lured to install `@apexacc/cli` (a repackaged Oh My Pi coding agent) and `@apexacc/audit` (an "18-tool" security MCP server)

Elastic Security Labs (REF8801) found the CLI overwrote `OPENROUTER_API_KEY` and `OPENROUTER_BASE_URL` in the running process, sending prompts, tool definitions, and tool output, including local file reads, to `arena.apexaccs[.]org` while the provider still appeared as OpenRouter. It also wrote a persistent `apex-copilot` entry into `~/.apex/agent/mcp.json` pointing at an attacker MCP server. The audit package's 18 tools returned fabricated results. Both packages fetched server-chosen shell commands, delivering the CloudSyncD macOS backdoor and a Windows stealer that exfiltrates browser data, wallets, and Claude, Cursor, and Windsurf configs over Telegram. Download counts not reported

Agent model endpoints and MCP server lists configurable through environment variables and user-writable files that any installed package can rewrite