Cybersecurity researchers have found a malicious npm package deal that masquerades as an OpenClaw installer to deploy a distant entry trojan (RAT) and steal delicate knowledge from compromised hosts.
The package deal, named “@openclaw-ai/openclawai,” was uploaded to the registry by a person named “openclaw-ai” on March 3, 2026. It has been downloaded 178 instances to this point. The library continues to be accessible for obtain as of writing.
JFrog, which found the package deal, stated it is designed to steal system credentials, browser knowledge, crypto wallets, SSH keys, Apple Keychain databases, and iMessage historical past, in addition to set up a persistent RAT with distant entry capabilities, SOCKS5 proxy, and stay browser session cloning.
“The assault is notable for its broad knowledge assortment, its use of social engineering to reap the sufferer’s system password, and the sophistication of its persistence and C2 [command-and-control] infrastructure,” safety researcher Meitar Palas stated. “Internally, the malware identifies itself as GhostLoader.”
The malicious logic is triggered by way of a postinstall hook, which re-installs the package deal globally utilizing the command: “npm i -g @openclaw-ai/openclawai.” As soon as the set up is full, the OpenClaw binary factors to “scripts/setup.js” by way of the “bin” property within the “package deal.json” file.
It is price noting that the “bin” subject is used to outline executable recordsdata that needs to be added to the person’s PATH throughout package deal set up. This, in flip, turns the package deal right into a globally accessible command-line device.
The file “setup.js” serves because the first-stage dropper that, upon working, shows a convincing faux command-line interface with animated progress bars to present the impression that OpenClaw is being put in on the host. After the purported set up step is full, the script exhibits a bogus iCloud Keychain authorization immediate, asking customers to enter their system password.
Concurrently, the script retrieves an encrypted second-stage JavaScript payload from the C2 server (“trackpipe[.]dev”), which is then decoded, written to a short lived file, and spawned as a indifferent baby course of to proceed working within the background. The temp file is deleted after 60 seconds to cowl up traces of the exercise.
“If the Safari listing is inaccessible (no Full Disk Entry), the script shows an AppleScript dialog urging the person to grant FDA to Terminal, full with step-by-step directions and a button that opens System Preferences straight,” JFrog defined. “This allows the second-stage payload to steal Apple Notes, iMessage, Safari historical past, and Mail knowledge.”
The JavaScript second-stage, that includes about 11,700 strains, is a full-fledged data stealer and RAT framework that is able to persistence, knowledge assortment, browser decryption, C2 communication, a SOCKS5 proxy, and stay browser cloning. It is also geared up to steal a variety of knowledge –
- macOS Keychain, together with each the native login.keychain-db and all iCloud Keychain databases
- Credentials, cookies, bank cards, and autofill knowledge from all Chromium-based browsers, similar to Google Chrome, Microsoft Edge, Courageous, Vivaldi, Opera, Yandex, and Comet
- Information from desktop pockets functions and browser extensions
- Cryptocurrency pockets seed phrases
- SSH keys
- Developer and cloud credentials for AWS, Microsoft Azure, Google Cloud, Kubernetes, Docker, and GitHub
- Synthetic intelligence (AI) agent configurations, and
- Information protected by the FDA, together with Apple Notes, iMessage historical past, Safari looking historical past, Mail account configurations, and Apple account data
Within the ultimate stage, the collected knowledge is compressed right into a tar.gz archive and exfiltrated by means of a number of channels, together with on to the C2 server, Telegram Bot API, and GoFile.io.
What’s extra, the malware enters a persistent daemon mode that permits it to observe clipboard content material each three seconds and transmit any knowledge that matches one of many 9 pre-defined patterns corresponding to non-public keys, WIF key, SOL personal key, RSA personal key, BTC handle, Ethereum handle, AWS key, OpenAI key, and Strike key.
Different options embrace preserving tabs on working processes, scanning incoming iMessage chats in real-time, and executing instructions despatched from the C2 server to run arbitrary shell command, open a URL on the sufferer’s default browser, obtain further payloads, add recordsdata, begin/cease a SOCKS5 proxy, record accessible browsers, clone a browser profile and launch it in headless mode, cease the browser clone, self-destruct, and replace itself.
The browser cloning operate is especially harmful because it launches a headless Chromium occasion with the present browser profile that incorporates cookies, login, and historical past knowledge. This provides the attacker a totally authenticated browser session with out the necessity for accessing credentials.
“The @openclaw-ai/openclawai package deal combines social engineering, encrypted payload supply, broad knowledge assortment, and a persistent RAT right into a single npm package deal,” JFrog stated.
“The polished faux CLI installer and Keychain immediate are convincing sufficient to extract system passwords from cautious builders, and as soon as captured, these credentials unlock macOS Keychain decryption and browser credential extraction that may in any other case be blocked by OS-level protections.”
