Fake Web3 accelerator pushed malware through npm packages, researchers say

Past-week coverage · Original source published 2026-10-19.

A fake Web3 accelerator was observed pushing information stealers and backdoors to Windows and macOS systems through malicious npm packages, according to an Elastic report covered by The Hacker News on October 19, 2026.

The lure was a familiar one for developer audiences. The packages were offered under the pretext of free artificial intelligence credits for Anthropic Claude and Google Gemini, coding tools, and security audits. Elastic's summary, quoted in the report, said the tools "delivered information-stealing malware and backdoors for macOS and Windows machines."

The headline also points to a second concern: hijacking traffic tied to AI agents. The retained source does not detail how that traffic was intercepted, so the mechanics remain unclear from what's available here.

Why it matters

Developers are a high-value target because their machines hold source code, credentials and access to build and deployment systems. A package that looks like a helpful tool for AI-assisted coding can slip past review when the pitch matches what teams are already looking for.

What defenders can do

• Treat unsolicited offers of free AI credits, tooling or audits as a reason to verify the sender independently.
• Review npm dependencies before installing, and check who publishes them.
• Limit what credentials and tokens are reachable from developer workstations.
• Watch for unexpected outbound connections from machines running AI coding agents.

The source did not name the packages, the affected versions or the number of victims.