Cybersecurity researchers have found a malicious npm bundle that masquerades as an OpenClaw installer to deploy a distant entry trojan (RAT) and steal delicate knowledge from compromised hosts.
The bundle, named “@openclaw-ai/openclawai,” was uploaded to the registry by a person named “openclaw-ai” on March 3, 2026. It has been downloaded 178 instances up to now. The library remains to be obtainable for obtain as of writing.
JFrog, which found the bundle, stated it is designed to steal system credentials, browser knowledge, crypto wallets, SSH keys, Apple Keychain databases, and iMessage historical past, in addition to set up a persistent RAT with distant entry capabilities, SOCKS5 proxy, and reside browser session cloning.
“The assault is notable for its broad knowledge assortment, its use of social engineering to reap the sufferer’s system password, and the sophistication of its persistence and C2 [command-and-control] infrastructure,” safety researcher Meitar Palas stated. “Internally, the malware identifies itself as GhostLoader.”
The malicious logic is triggered via a postinstall hook, which re-installs the bundle globally utilizing the command: “npm i -g @openclaw-ai/openclawai.” As soon as the set up is full, the OpenClaw binary factors to “scripts/setup.js” via the “bin” property within the “bundle.json” file.
It is price noting that the “bin” area is used to outline executable information that must be added to the person’s PATH throughout bundle set up. This, in flip, turns the bundle right into a globally accessible command-line software.
The file “setup.js” serves because the first-stage dropper that, upon working, shows a convincing pretend command-line interface with animated progress bars to present the impression that OpenClaw is being put in on the host. After the purported set up step is full, the script exhibits a bogus iCloud Keychain authorization immediate, asking customers to enter their system password.
Concurrently, the script retrieves an encrypted second-stage JavaScript payload from the C2 server (“trackpipe[.]dev”), which is then decoded, written to a short lived file, and spawned as a indifferent little one course of to proceed working within the background. The temp file is deleted after 60 seconds to cowl up traces of the exercise.
“If the Safari listing is inaccessible (no Full Disk Entry), the script shows an AppleScript dialog urging the person to grant FDA to Terminal, full with step-by-step directions and a button that opens System Preferences straight,” JFrog defined. “This allows the second-stage payload to steal Apple Notes, iMessage, Safari historical past, and Mail knowledge.”
The JavaScript second-stage, that includes about 11,700 traces, is a full-fledged info stealer and RAT framework that is able to persistence, knowledge assortment, browser decryption, C2 communication, a SOCKS5 proxy, and reside browser cloning. It is also geared up to steal a variety of information –
- macOS Keychain, together with each the native login.keychain-db and all iCloud Keychain databases
- Credentials, cookies, bank cards, and autofill knowledge from all Chromium-based browsers, akin to Google Chrome, Microsoft Edge, Courageous, Vivaldi, Opera, Yandex, and Comet
- Knowledge from desktop pockets functions and browser extensions
- Cryptocurrency pockets seed phrases
- SSH keys
- Developer and cloud credentials for AWS, Microsoft Azure, Google Cloud, Kubernetes, Docker, and GitHub
- Synthetic intelligence (AI) agent configurations, and
- Knowledge protected by the FDA, together with Apple Notes, iMessage historical past, Safari shopping historical past, Mail account configurations, and Apple account info
Within the remaining stage, the collected knowledge is compressed right into a tar.gz archive and exfiltrated by means of a number of channels, together with on to the C2 server, Telegram Bot API, and GoFile.io.
What’s extra, the malware enters a persistent daemon mode that permits it to watch clipboard content material each three seconds and transmit any knowledge that matches one of many 9 pre-defined patterns corresponding to non-public keys, WIF key, SOL non-public key, RSA non-public key, BTC handle, Ethereum handle, AWS key, OpenAI key, and Strike key.
Different options embrace holding tabs on working processes, scanning incoming iMessage chats in real-time, and executing instructions despatched from the C2 server to run arbitrary shell command, open a URL on the sufferer’s default browser, obtain extra payloads, add information, begin/cease a SOCKS5 proxy, listing obtainable browsers, clone a browser profile and launch it in headless mode, cease the browser clone, self-destruct, and replace itself.
The browser cloning operate is especially harmful because it launches a headless Chromium occasion with the prevailing browser profile that comprises cookies, login, and historical past knowledge. This provides the attacker a totally authenticated browser session with out the necessity for accessing credentials.
“The @openclaw-ai/openclawai bundle combines social engineering, encrypted payload supply, broad knowledge assortment, and a persistent RAT right into a single npm bundle,” JFrog stated.
“The polished pretend CLI installer and Keychain immediate are convincing sufficient to extract system passwords from cautious builders, and as soon as captured, these credentials unlock macOS Keychain decryption and browser credential extraction that may in any other case be blocked by OS-level protections.”
