If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
@apexacc/audit is the companion package to @apexacc/cli in the "Apex Accelerator" campaign (Elastic Security Labs REF8801, 2026-10-12). It exposes an MCP server with 18 "security tools" that all return fabricated output (for example a fixed Slither report and a "NOT A HONEYPOT" verdict), registers itself in Claude Desktop, Cursor and Windsurf MCP configs, and on Windows requests elevation to add a Defender exclusion for its folder and attempts to disable Smart App Control. It carries the same verification bootstrap as @apexacc/cli (macOS CloudSyncD dropper; Windows staged infostealer). The package returns "Not found" from the npm registry as of 2026-10-15, but installed copies persist. All versions affected. Indicators from Elastic's report.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- apexaccs[.]org other packages →
- arena[.]apexaccs[.]org other packages →
- token[.]apexaccs[.]org other packages →
- vrf[.]apexaccs[.]org other packages →
- arena[.]apexfdn[.]xyz other packages →
- verify[.]apexfdn[.]xyz other packages →
- ccmihr[.]com other packages →
- 0auth-chromium[.]com other packages →
- ehegisnightmare[.]icu other packages →
- arenapex[.]cloud other packages →
- cloudmain365duo[.]top other packages →
- fdn4apex[.]com other packages →
- main[.]router-apex[.]com other packages →
- update[.]apex-arena-router[.]com other packages →