Malicious npm Package Disguises as OpenClaw to Deploy GhostClaw RAT

Malicious npm Package Disguises as OpenClaw to Deploy GhostClaw RAT

First seen 10 Mar 2026, 11:25 UTC •CybersecuritynewsCsoonlineSocradarMexcEsecurityplanet+9 •68.0

Article Content

Browse articles
ThreatCluster

A rogue npm package named '@openclaw-ai/openclawai' has been identified as a malicious installer for a remote access trojan (RAT) known as GhostClaw. This malware targets software developers, stealing sensitive information such as system credentials, browser data, cryptocurrency wallets, and SSH keys. The attack employs a multi-stage infection chain, posing a significant risk to affected users.

How this analysis works

Timeline

2026-03-10
Malicious npm package '@openclaw-ai/openclawai' discovered
2026-03-10
JFrog research reports on GhostClaw RAT deployment
Date unknown
Attack targets software developers with fake OpenClaw installer

Extracted Entities

1 / 2