Fake Web3 accelerator used npm packages to spread stealers

A campaign run under the cover of a fake Web3 accelerator used malicious npm packages to deliver information-stealing malware and backdoors to Windows and macOS machines, and to hijack AI agent traffic, according to a report published on 19 October 2026.

The findings were attributed to Elastic, whose researchers said the tools pushed by the operation "delivered information-stealing malware and backdoors for macOS and Windows machines". The packages were distributed through npm, the public registry that developers use to install JavaScript and Node.js code, and were presented as legitimate offerings from an accelerator programme.

The lures were aimed squarely at developers working with AI tooling. According to the report, the operators offered free AI credits for Anthropic Claude and Google Gemini, along with coding tools and security audits. Developers who took up the offer installed the packages themselves, which is what gave the malware its route onto the machine. There is no suggestion in the report that Anthropic or Google were compromised, or that either company was involved; their products were used as bait.

The campaign also hijacked AI agent traffic, the report says. That matters because coding agents and assistants typically run with the same local permissions as the developer, hold API keys, and send requests out to model providers. Traffic interception sits directly on that path. The available reporting does not set out the technical detail of how the hijacking worked, what was captured, or whether credentials for the AI services were among the data taken.

Several basic facts about the campaign are not yet public in the material published so far. The number of malicious packages, their names, how long they were available on npm, how many times they were downloaded, and whether they have since been removed from the registry are all unstated. There is no published figure for how many organisations or individuals were affected, and no information on when the activity began.

For teams running AI coding agents, the pattern is a familiar supply chain problem wearing new clothes. The attack did not break the agent. It broke the developer's trust in a package, and the agent's access came along with it. Free-credit offers that require installing code are a straightforward delivery mechanism, because the reward is tied to running something unvetted on a workstation that already holds secrets.

The Agentic Times has not independently verified the findings. Elastic's research is the single source for the technical claims described here, and further detail may follow as the company publishes more on the campaign. Developers who installed packages from an unfamiliar Web3 accelerator offering discounted or free model credits should treat any API keys and credentials held on those machines as potentially exposed until they can establish otherwise.