Our takeElastic's report on the fake Web3 accelerator (REF8801) is corroborated; malicious npm packages delivered stealers and backdoors while hijacking AI agent traffic to attacker-controlled infrastructure. No technical mechanism for the traffic hijack has been disclosed.Security Resilience desk
Sources (2)
- hackernews · hackernews
- the420_in · the420_in
What this means for you — Security leader:Audit npm dependencies in any AI-tooling or accelerator-related projects; block execution of unexpected packages and monitor for anomalous outbound traffic to unknown infrastructure.
What this means for you — Lean IT orgs:Only install npm packages from sources you fully trust; if a Web3 or AI-credit offer asks you to run new code or packages, treat it as malware and walk away.
What this means for you — MSP:Scan client npm projects and package.json files for suspicious or recently published packages; watch for outbound connections that could indicate hijacked AI-agent traffic.
What this means for you — Researcher:The campaign used malicious npm packages to deliver stealers and backdoors while hijacking AI agent traffic; no technical mechanism for the traffic interception or redirection has been disclosed.