Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic

As cited

Copy frozen at 2026-10-19 14:05 UTC (site build).

threat intel

Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic

Threat actors operating a fake Web3 accelerator distributed malicious npm packages claiming to offer free artificial intelligence (AI) credits for Claude and Gemini, along with coding tools and security audits. The packages deployed information stealers and backdoors targeting both Windows and macOS systems. Elastic researchers identified the campaign distributing these compromised dependencies.

Why it matters: Developers using npm packages for AI tools face credential theft and system compromise; practitioners should audit npm package sources and monitor for suspicious dependency updates in development environments.

Source published

2026-10-19 10:06 UTC

First seen by Cybersecurity Tracker

2026-10-19 12:52 UTC