+- Hack Forums (https://hackforums.net)
+-- Forum: General Topics (https://hackforums.net/forumdisplay.php?fid=7)
+--- Forum: World (https://hackforums.net/forumdisplay.php?fid=445)
+---- Forum: News and Happenings (https://hackforums.net/forumdisplay.php?fid=89)
+---- Thread: Malicious npm Package Posing as OpenClaw Installer Deploys RAT, Steals macOS Credent (/showthread.php?tid=6322170)
Malicious npm Package Posing as OpenClaw Installer Deploys RAT, Steals macOS Credent - Stanley - Mar 17, 2026
Malicious npm Package Posing as OpenClaw Installer Deploys RAT, Steals macOS Credent
Cybersecurity researchers have discovered a malicious npm package that masquerades as an OpenClaw installer to deploy a remote access trojan (RAT) and steal sensitive data from compromised hosts.
The package, named "@openclaw-ai/openclawai," was uploaded to the registry by a user named "openclaw-ai" on March 3, 2026. It has been downloaded 178 times to date. The library is still available for
https://thehackernews.com/2026/03/malicious-npm-package-posing-as.html
RE: Malicious npm Package Posing as OpenClaw Installer Deploys RAT, Steals macOS Credent - shakur123 - Mar 18, 2026
Supply chain 101—low downloads don’t matter when targeting dev environments.
Fake “OpenClaw” npm installer pushing a RAT on macOS = credential theft + persistence entry point. Once it lands, it’s not about 178 installs—it’s about who installed it.
Same pattern: trust abuse, typosquatting vibes, and zero scrutiny on dependencies.