# Fake Web3 accelerator packages steal data and redirect AI agent requests

_Published Monday, October 19, 2026 at 8:49 AM EDT · Security, AI · Latest · Tier 2 — Notable_

![Fake Web3 accelerator packages steal data and redirect AI agent requests — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAw5A6yrE0NkMreq5lBZaS4ndrFrorAZaVrjJ218aS1RcJoQVYOJOVejIn8rBH5RHIIZ_cpvtzHnQMwMMWVOFbpfcs01tolLCmlYAY3qy-onWaOUQhzB6H2VjlWaUgBCL_0vAjRB7VmumClnaiIxDds6j9wD3lt9vD-kptWl6bUft29O6Z0cTNgBQV6t76/s1700-nu-rw-lo-l85-e365/npm-apex.jpg)

Elastic Security Labs researchers identified malicious npm packages posing as tools from a Web3 accelerator that deploy Windows information stealers and macOS backdoors while redirecting AI agent requests through attacker-controlled services. The operation targets cryptocurrency startups and founders with offers of investment, free AI credits, and security audits.

The packages can intercept OpenRouter traffic and register an attacker-controlled server in an agent's configuration. That exposes prompts, conversation history, code snippets, and tool outputs, while allowing attackers to supply instructions that influence subsequent agent actions. Their purported security tools fabricate findings. The packages and associated GitHub repositories are no longer accessible.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/fake-web3-accelerator-uses-npm-packages.html)

---
Canonical: https://techandbusiness.org/newswire/S7FIZ5PgYFkNGU7DvgytfR
Published: 2026-10-19T12:49:42.449Z
Story chronology: 2026-10-19T10:06:40.000Z
Retrieved: 2026-10-19T15:01:03.213Z
Publisher: Tech & Business (techandbusiness.org)