Fake Apex Accelerator npm packages spread stealers and backdoors
@apexacc/cli and @apexacc/audit promised AI credits and audits but delivered Windows and macOS malware instead.
74
- Mentions · 7d0
- Mentions · 30d5
- All mentions15
- First seenAug 11, 2026
- Last mentioned11d ago
Timeline
15 articles · newest firstMALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
Malicious npm package imgdecode, tied to MALFEX, loads a DLL that downloads and injects shellcode.
74
ChainDrop and PolinRider Use Blockchain C2 to Steal Cloud and CI/CD Credentials
ChainDrop and North Korea-linked PolinRider use blockchain C2 to steal cloud and CI/CD credentials.
78
MALFEX npm Malware Hides Executables in PNG Files to Infect Windows Developers
MALFEX npm packages hide Windows malware in fake PNG files, delivering Overlord RAT and the movinlike stealer.
72
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
Compromised tensorlake npm 0.5.144 delivered the Shai-Hulud worm to steal secrets and spread to other packages.
73
npm registry keeps removed-version timestamps but drops the reason (Sept 2025 campaign as evidence)
npm keeps timestamps for removed package versions but drops the removal reason, hindering supply-chain response.
36
Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials
Malicious npm package tw-pkgprobe-7731 posed as a Twilio bug-bounty probe and can steal credentials.
58
Malicious npm Package With 2 Million Downloads Hides Malware in Runtime Code
Malicious npm package 'indexed-btree' with 2M weekly downloads hides runtime malware using blockchain-based command-and-control.
75
Malicious npm packages evade install-script defenses at runtime
Malicious npm package 'indexed-btree' hides a loader in runtime code to evade install-script defenses, reaching 2 million weekly downloads alongside nine related packages.
78
TanStack Supply Chain Attack Lets Hackers Steal 170 Private CrowdSec GitHub Repositories
Attackers used an OAuth token stolen in the TanStack npm supply chain attack to clone 170 private CrowdSec GitHub repositories, later leaked on a forum.
70
Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer
CrowdStrike ties the PhantomRaven npm infostealer, active since 2022, to a self-described bug bounty hunter who likely wrote it with an LLM.
55
AI Coding Tools Now a Prime Target for Threat Actors, Google Warns
Google Threat Intelligence Group warns threat actors increasingly target AI coding tools and proprietary AI data, with UNC6780's Dustmaker enabling large-scale supply chain compromises.
75
16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
Typosquatted RubyGems packages deliver the StubMaker infostealer, stealing browser credentials, crypto wallets, and Telegram data from Windows developers.
55
Tracking Shai-Hulud: Inside the ChainDrop NPM Worm
ChainDrop, a Mini Shai-Hulud variant tied to TeamPCP, worms through npm via a compromised maintainer account and anchors C2 in an Ethereum smart contract.
68
Nearly 800 Malicious npm Packages Deliver Cross
Nearly 800 typo-squatted npm packages deliver WEL1DROPPER, a cross-platform downloader installing RAT and infostealer payloads on Windows, macOS, Linux.
72
Related CVEs
by mentions- CVE-2026-453213%9.6Supply chain compromise: credential-stealing code in 42 @tanstack/* npm packages
Appears with
- npmproduct · 7
- GitHubvendor · 5
- Checkmarxorganization · 3
- SafeDeporganization · 3
- Shai-Huludmalware · 3
- movinlikemalware · 2
- Socketorganization · 2
- Overlord RATmalware · 2
- MALFEXmalware · 2
- ChainDropmalware · 2
- GitHuborganization · 2
- GitHub Actionsproduct · 2
- StepSecurityorganization · 1
- OpenSourceMalwarevendor · 1
- imgdecodemalware · 1
- ordered-kv-indexmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.