Cybersecurity researchers uncover GhostLoader malware hidden in fake OpenClaw npm package

Back Mexc

Cybersecurity researchers uncover GhostLoader malware hidden in fake OpenClaw npm package

Mexc • March 11, 2026

Share: View original

A malicious npm package disguised as a legitimate AI tool to install the virally popular OpenClaw, but designed to steal system passwords and ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious npm Package Disguises as OpenClaw to Deploy GhostClaw RAT A rogue npm package named '@openclaw-ai/openclawai' has been identified as a malicious installer for a remote access trojan (RAT) known as GhostClaw. This malware targets software developers, stealing sensitive information such as system credentials, browser data, cryptocurrency wallets, and SSH keys. The attack employs a multi-stage infection chain, posing a significant risk to affected users. 15 sources 68

Extracted Entities

Attack Types (2)

Malware Supply Chain Attack

Malware (1)

MITRE ATT&CK (2)

T1003 - OS Credential Dumping T1195 - Supply Chain Compromise

Tools (1)