GhostLoader Malware Spreads Through Fake OpenClaw npm Package

Socradar • March 10, 2026

Share: View original

Security researchers uncovered a malicious npm package distributing GhostLoader, a sophisticated information‑stealing malware framework.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious npm Package Disguises as OpenClaw to Deploy GhostClaw RAT A rogue npm package named '@openclaw-ai/openclawai' has been identified as a malicious installer for a remote access trojan (RAT) known as GhostClaw. This malware targets software developers, stealing sensitive information such as system credentials, browser data, cryptocurrency wallets, and SSH keys. The attack employs a multi-stage infection chain, posing a significant risk to affected users. 15 sources 68

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

T1195 - Supply Chain Compromise

Tools (1)