Vulnerability MAL-2026-17923

@apexacc/audit is the companion package to @apexacc/cli in the "Apex Accelerator" campaign (Elastic Security Labs REF8801, 2026-10-12). It exposes an MCP server with 18 "security tools" that all return fabricated output (for example a fixed Slither report and a "NOT A HONEYPOT" verdict), registers itself in Claude Desktop, Cursor and Windsurf MCP configs, and on Windows requests elevation to add a Defender exclusion for its folder and attempts to disable Smart App Control. It carries the same verification bootstrap as @apexacc/cli (macOS CloudSyncD dropper; Windows staged infostealer). The package returns "Not found" from the npm registry as of 2026-10-15, but installed copies persist. All versions affected. Indicators from Elastic's report.