Critical Malicious Code Vulnerability in @apexacc/audit Package
Summary
MAL-2026-17923: Malicious code in @apexacc/audit (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @apexacc/audit package is part of the 'Apex Accelerator' campaign, which is associated with security tools designed to assist developers. This package is intended to work alongside @apexacc/cli, providing various security functionalities. However, it has been found to expose a malicious MCP server that fabricates security tool outputs, posing significant risks to users and their systems.
Vulnerability Detail
The vulnerability originates from the @apexacc/audit package, which has been identified as containing malicious code that creates a false sense of security. It registers itself in multiple MCP configurations and attempts to elevate privileges on Windows systems to disable security features like Smart App Control and add exclusions in Windows Defender. This behavior can lead to severe security breaches, as it misleads users into believing their systems are secure while they are actually compromised.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @apexacc/auditIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can monitor your project's dependencies using tools like Vulert. By utilizing Vulert's playground at https://vulert.com/scanner, you can check if your application is affected by this vulnerability without requiring any signup. This tool analyzes your package-lock.json file to alert you in real-time about open-source vulnerabilities.
Conclusion
The @apexacc/audit package has been identified as containing malicious code that poses significant security risks. Users are advised to uninstall the package immediately and monitor their dependencies for vulnerabilities using tools like Vulert. Staying informed and proactive is crucial in maintaining the security of your applications.
See every vulnerability recorded for @apexacc/audit →
FAQ
The @apexacc/audit package is a companion tool for the @apexacc/cli package, designed to provide security functionalities for developers.
The vulnerability can lead to compromised security, as the package fabricates security tool outputs and can disable important security features on your system.
If you have the @apexacc/audit package installed, you should uninstall it immediately using the command: npm uninstall @apexacc/audit.
No, the @apexacc/audit package has been removed from the npm registry, and there are no patched versions available.
You can use tools like Vulert to monitor your project's dependencies in real-time for open-source vulnerabilities by analyzing your package-lock.json file.
