Critical Malicious Code Vulnerability in @apexacc/cli Package
Summary
MAL-2026-17924: Malicious code in @apexacc/cli (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @apexacc/cli package is a command-line interface tool distributed by Apex Accelerator, a fraudulent Web3 accelerator targeting crypto founders. This package is designed to assist developers with AI coding tasks but has been found to contain malicious code that compromises user security and data integrity.
Vulnerability Detail
The vulnerability originates from the @apexacc/cli package, which is a repackaged version of the Oh My Pi coding agent. It includes malicious modifications that redirect developer traffic to attacker-controlled servers, persist a remote server configuration, and enable unauthorized command execution. The malicious code can exfiltrate sensitive data such as browser credentials and cryptocurrency wallet information, posing significant risks to users' security and privacy.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @apexacc/cliIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the @apexacc/cli package and seek alternative tools for their development needs. Additionally, ensure that security software is up to date to help mitigate potential threats from malicious activities.
Conclusion
The @apexacc/cli package contains a critical vulnerability that poses significant risks to developers and their projects. Immediate action is required to mitigate these risks by uninstalling the package and seeking alternatives. Users are encouraged to utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for @apexacc/cli →
FAQ
The @apexacc/cli package is a command-line interface tool designed to assist developers with AI coding tasks, but it has been compromised with malicious code.
The vulnerability can lead to unauthorized access to sensitive information, including browser credentials and cryptocurrency wallets, potentially resulting in financial loss.
Immediately uninstall the package and monitor for any updates or patches. Consider using alternative tools for your development work.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Yes, there are various other CLI tools available for AI coding assistance. Research and select a reputable alternative that meets your needs.
