Fake OpenClaw npm Package Installs GhostClaw Malware

Back Esecurityplanet

Fake OpenClaw npm Package Installs GhostClaw Malware

Esecurityplanet • March 11, 2026

Share: View original

A malicious npm package disguised as OpenClaw installs GhostClaw malware to steal developer credentials and sensitive data.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious npm Package Disguises as OpenClaw to Deploy GhostClaw RAT A rogue npm package named '@openclaw-ai/openclawai' has been identified as a malicious installer for a remote access trojan (RAT) known as GhostClaw. This malware targets software developers, stealing sensitive information such as system credentials, browser data, cryptocurrency wallets, and SSH keys. The attack employs a multi-stage infection chain, posing a significant risk to affected users. 15 sources 68

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

T1195 - Supply Chain Compromise