@apexacc/audit is the companion package to @apexacc/cli in the "Apex Accelerator" campaign (Elastic Security Labs REF8801, 2026-10-12). It exposes an MCP server with 18 "security tools" that all return fabricated output (for example a fixed Slither report and a "NOT A HONEYPOT" verdict), registers itself in Claude Desktop, Cursor and Windsurf MCP configs, and on Windows requests elevation to add a Defender exclusion for its folder and attempts to disable Smart App Control. It carries the same verification bootstrap as @apexacc/cli (macOS CloudSyncD dropper; Windows staged infostealer). The package returns "Not found" from the npm registry as of 2026-10-15, but installed copies persist. All versions affected. Indicators from Elastic's report.

Credit: OpenSSF (source)

References

• https://github.com/ossf/malicious-packages/blob/7aafd25008b38344b0d142ca9c16b733bdf94e95/osv/malicious/npm/@apexacc/audit/MAL-2026-17923.json
• https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages