An experimental AI agent called ROME autonomously hijacked Alibaba's training GPUs for cryptocurrency mining, creating reverse SSH tunnels to bypass firewalls. It's the first documented case of an AI ...

Discover what OpenClaw 2.0 is, how it works, and how its Gateway, AI agents, models, memory, tools, and automation work together.

Claws.ws is a dynamic, memorable domain name with a fierce edge that instantly captures attention. This 5-letter, 1-syllable powerhouse evokes feelings of strength, agility, and precision. Perfect for a range of industries, from e-commerce

OpenClaw AI faced poisoned plugins in its hub, raising supply-chain risk that could enable data theft and compromise.

Researchers say a malicious npm package named @openclaw-ai/openclawai masqueraded as an OpenClaw installer, deployed a remote access trojan, and stole sensitive data from macOS systems after being uploaded by a user named openclaw-ai on March 3, 2026.

A dangerous malware campaign targeting software developers has surfaced, with a rogue npm package posing as a trusted developer tool to silently drain credentials, crypto wallets, SSH keys, browser sessions, and even iMessage conversations. The package, published under the name  @openclaw-ai/openclawai , disguises itself as a legitimate command-line installer called “OpenClaw Installer” while deploying a deeply hidden infection chain operating entirely in the background. Internally, the malware identifies itself as GhostLoader, though the broader campaign is tracked under the name GhostClaw.​ The malware specifically targets developers who rely on the npm ecosystem as part of their daily workflows. Once a developer runs the install command, the package quietly re-installs itself globally through a  postinstall  hook, ensuring the malicious binary lands on the system PATH without drawing any attention. From that point, the binary points to  setup.js , the obfuscated first-stage dropper that kicks off the full infection chain. This level of deception clearly reveals how carefully the attackers engineered GhostClaw to blend in with ordinary development tooling from the very start.​ JFrog Security researchers identified this malicious npm package on March 8, 2026, while actively monitoring the npm registry for suspicious behavior patterns. Researcher Meitar Palas carefully documented the full scope of the attack, covering its multi-stage payload architecture, social engineering mechanisms, and a persistent remote access framework capable of giving the attacker long-term, undetected access to the compromised developer machine.​ What makes GhostClaw especially alarming is the sheer range of data it collects. From system passwords and macOS Keychain databases to cloud credentials stored in AWS, GCP, and Azure configuration files, the malware leaves virtually nothing untouched. It also scans desktop folders for BIP-39 cryptocurrency seed phrases, captures all browser-saved passwords and credit cards across multiple Chromium-based browsers, and grabs iMessage history when it can obtain Full Disk Access on macOS.​ The attack does not limit itself to a single platform. GhostClaw targets macOS, Linux, and Windows developers alike, adapting its credential validation method to match whichever operating system it lands on. This cross-platform reach, combined with well-designed evasion and persistence techniques, clearly makes it one of the more complete and dangerous developer-targeting threats seen on the npm registry in recent years.​ Social Engineering at the Core The most striking part of the GhostClaw infection chain is how it tricks developers into willingly handing over their system passwords. OpenClaw installer (Source – JFrog) After a developer runs the install command, the first-stage dropper,  setup.js , presents a convincing fake CLI installer complete with animated progress bars and realistic system log output. Once the progress display finishes, the script immediately shows a dialog designed to look exactly like a native macOS Keychain authorization prompt, asking the user to enter their administrator password to complete a “secure vault initialization.”​ GhostLoader (Source – JFrog) The attacker allows up to five password attempts, validating each one against the real operating system’s authentication mechanism so that an incorrect entry produces an authentic-looking failure message. While the victim interacts with this dialog, the script simultaneously fetches the second-stage payload from the attacker’s command-and-control server at  trackpipe[.]dev , decoding it using AES-256-GCM encryption with a matching key delivered in the same server response. The fully decrypted payload — roughly 11,700 lines of JavaScript — forms the complete GhostLoader framework, which then installs itself deep into a hidden directory disguised as a routine npm telemetry service and quietly begins harvesting everything it can reach on the compromised machine.​ Developers who installed this package should remove the  .npm_telemetry  directory, check shell configuration files such as  ~/.zshrc ,  ~/.bashrc , and  ~/.bash_profile  for injected hook lines, terminate any running  monitor.js  processes, and fully uninstall the package. All credentials — including system passwords, SSH keys, API tokens for AWS, GCP, Azure, OpenAI, Stripe, and GitHub, along with any exposed crypto wallet seed phrases — must all be rotated immediately. Active browser sessions on Google, GitHub, and any other platform should be revoked to prevent unauthorized access . Given the depth at which this malware embeds itself, a complete system re-image is strongly recommended. Follow us on  Google News ,  LinkedIn , and  X  to Get More Instant Updates ,  Set CSN as a Preferred Source in  Google . The post GhostClaw Mimic as OpenClaw to Steal Everything from Developers appeared first on Cyber Security News .

Malicious npm package '@openclaw-ai/openclawai' downloaded 178 times installs GhostLoader RAT, stealing credentials and crypto wallets.

A malicious npm package posing as an OpenClaw Installer has been caught deploying a remote access trojan (RAT) on victim machines, according to new JFrog research. The package, published under the name “@openclaw-ai/openclawai”, pretends to be an installer for the legitimate CLI tool but instead launches a multi-stage infection chain that steals system credentials, browser data, cryptocurrency wallets, SSH Keys, and Apple Keychain databases before establishing persistence. “The attack is notable for its broad data collection, its use of social engineering to harvest the victim’s system password, and the sophistication of its persistence and C2 infrastructure,” JFrog researchers said in a blog post. Internally, the malware identified itself as “GhostLoader.” ## Social engineering for harvesting credentials Researchers explained that the published package includes a safe-looking JavaScript utility and typical project metadata, hiding the malicious logic in its “scripts” directory. The trigger occurs during installation. A postinstall script installs the package globally, ensuring the attacker-controlled binary lands on the system PATH. This binary then launches an obfuscated setup script that acts as the first-stage dropper. On execution, the dropper displays what appears to be a legitimate command-line installer with animated progress bars and system messages. However, behind the scenes, the malware simultaneously fetches a second-stage payload from a remote server. As the fake installation sequence finishes, the user is prompted to provide administrator credentials which are validated against the operating system. Upto 5 attempts are allowed, and “Failed attempts show ‘Authentication failed. Please try again.’ – exactly mimicking real OS behavior,” researchers added. While the user believes the installation has completed normally, the actual payload continues executing silently in the background. ## From password theft to persistence The second stage malware, internally referred to as “GhostLoader,” is a large JavaScript bundle implementing both an infostealer and a remote access framework. Once launched, GhostLoader installs itself into a hidden directory disguised as an npm telemetry service and sets up persistence mechanisms which include shell configuration hooks that automatically relaunch the malware if it stops running. Parallelly, the malware begins harvesting sensitive data across the system. According to the researchers, the payload targets browser credentials, saved cookies, SSH keys, cryptocurrency wallets, Apple Keychain data, and personal application data such as iMessage history and email records. The malware also has a RAT component that enables remote operators to route traffic through the infected machine using a SOCKS5 proxy and even clone active browser sessions, allowing attackers to impersonate users in real time. The campaign includes several anti-forensics techniques designed to evade detection and analysis. The GhostClaw payload hides its behavior through heavy obfuscation and staged execution, decrypting key components only at runtime and removing temporary artifacts generated during the installation process. JFrog researchers noted that the campaign marks another abuse of npm’s ability to execute installation scripts. They advised developers to treat npm packages that request system credentials, execute postinstall scripts, or download external payloads during installation as suspicious, and recommended installing developer tools only from verified or official sources.

Malicious npm package '@openclaw-ai/openclawai' downloaded 178 times installs GhostLoader RAT, stealing credentials and crypto wallets.

Cybersecurity researchers have discovered a malicious npm package that masquerades as an OpenClaw installer to deploy a remote access trojan (RAT) and steal sensitive data from compromised hosts. The package, named "@openclaw-ai/openclawai," was uploaded to the registry by a user named "openclaw-ai" on March 3, 2026. It has been downloaded 178 times to date. The library is still available for

Introduction: A sophisticated supply chain attack has been uncovered in the npm ecosystem, where a malicious package named @openclaw-ai/openclawai masquerades as the legitimate OpenClaw CLI tool. Dubbed “GhostClaw” by researchers, this threat deploys a full-featured infostealer and remote access trojan (RAT) against developers’ machines. By exploiting the trust in open-source dependencies and using a stealthy postinstall hook, attackers can exfiltrate SSH keys, cloud credentials, AI agent configurations, and live browser sessions.

Introduction: The convergence of Artificial Intelligence and system administration is rapidly reshaping the cybersecurity landscape. OpenClaw.ai emerges as a disruptive tool that allows security professionals to control their operating systems using natural language, turning complex command-line operations into simple conversational instructions. For bug bounty hunters and penetration testers, this capability translates to the ability to automate reconnaissance, install toolchains, and manage servers at the speed of thought, fundamentally changing how we approach offensive security workflows.

Malicious npm package '@openclaw-ai/openclawai' downloaded 178 times installs GhostLoader RAT, stealing credentials and crypto wallets.

Malicious npm package '@openclaw-ai/openclawai' downloaded 178 times installs GhostLoader RAT, stealing credentials and crypto wallets.