Fake Web3 Accelerator Uses Malicious npm Packages to Target Crypto Founders

A fake Web3 accelerator called Apex has been using malicious npm packages to target cryptocurrency start-ups and founders with what appeared to be free AI credits, coding tools, smart-contract audits, investment access, and invitations to in-person events. Behind the polished Web3 pitch, the operation delivered malware for macOS and Windows, exposed AI-agent data to attacker-run systems, and provided false security results that could mislead teams into trusting unsafe code. The campaign used two npm packages, @apexacc/cli and @apexacc/audit, presented as an AI coding agent and a Model Context Protocol (MCP) security-audit tool. Users who ran the packages through npm or npx could trigger a multistage infection chain. The...

Read the full article at the source.