Malicious npm packages posed as a Web3 accelerator offering AI credits

Elastic Security Labs identified a malicious npm package that led to an operation presented as a Web3 accelerator. According to the report, the group spent months building a public presence, offering free AI credits and programming tools, plus security audits and an in-person event announced through a dedicated invitation page. The tools delivered information-stealing malware and backdoors for macOS and Windows. The operation also repackaged a legitimate programming agent to send model requests through attacker-controlled services, and its audit tools produced fabricated security findings. In a separate test, the remote scoring service of one package returned 51 out of 100 for a fictitious project, stating that its AI evaluator was unavailable. The research began with an alert from supply chain monitoring and was linked to an earlier campaign reported by another security firm. The researchers say the aim is to raise awareness of scams that use AI-generated code, sites and portfolios to appear legitimate. To verify, consult the original report published by Elastic Security Labs, found in the source feed, and check the dates and indicators described before taking any action.