[Stanley]

Malicious npm Package Posing as OpenClaw Installer Deploys RAT, Steals macOS Credent

Cybersecurity researchers have discovered a malicious npm package that masquerades as an OpenClaw installer to deploy a remote access trojan (RAT) and steal sensitive data from compromised hosts.
The package, named "@openclaw-ai/openclawai," was uploaded to the registry by a user named "openclaw-ai" on March 3, 2026. It has been downloaded 178 times to date. The library is still available for

https://thehackernews.com/2026/03/malici...ng-as.html

[shakur123]

Supply chain 101—low downloads don’t matter when targeting dev environments.

Fake “OpenClaw” npm installer pushing a RAT on macOS = credential theft + persistence entry point. Once it lands, it’s not about 178 installs—it’s about who installed it.

Same pattern: trust abuse, typosquatting vibes, and zero scrutiny on dependencies.