Malicious npm Package Uses Fake OpenClaw Installer to Deploy macOS RAT
Summary
JFrog found the npm package @openclaw-ai/openclawai masquerading as an OpenClaw installer. Its GhostLoader payload harvests macOS credentials and data, installs a persistent RAT, and exfiltrates data to trackpipe[.]dev and other services.
Key points
- JFrog reported that @openclaw-ai/openclawai was uploaded on March 3, 2026, and had 178 downloads; the article said it remained available.
- A postinstall hook reinstalls the package globally and runs setup.js, which displays a fake installer and iCloud Keychain prompt to capture the user's system password.
- The setup script retrieves an encrypted second-stage payload from trackpipe[.]dev and launches it as a background process.
- The GhostLoader payload targets macOS Keychain data, browser credentials and sessions, cryptocurrency wallets, SSH keys, cloud credentials, and other data.
- The malware can persist, monitor clipboard contents for key-related patterns, and exfiltrate collected data to its C2, Telegram Bot API, and GoFile.io.
- Its RAT features include remote command execution, SOCKS5 proxy control, file transfer, and headless browser-profile cloning for authenticated sessions.
Article Details
- Attack Vectors
- The malicious npm package @openclaw-ai/openclawai impersonates an OpenClaw installer and uses a postinstall hook to run setup.js.
- The fake installer displays an iCloud Keychain prompt to trick users into entering their system password.
- The package retrieves an encrypted JavaScript payload from trackpipe[.]dev and runs it as a detached background process.
- Defensive Notes
- The article reports that @openclaw-ai/openclawai remained available on the npm registry at the time of writing.
- The article reports that the installer prompts users to grant Terminal Full Disk Access; this permission enables access to additional macOS data.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | trackpipe[.]dev | C2 domain used to deliver the encrypted second-stage payload and receive stolen data. |
MITRE ATT&CK
T1005 · Data from Local SystemGhostLoader collects local data including Keychain contents, browser data, SSH keys, wallet data, and messages.T1041 · Exfiltration Over C2 ChannelCollected data is exfiltrated directly to the C2 server.T1056.002 · GUI Input CaptureA fake CLI and iCloud Keychain prompt are used to capture the victim's system password.T1057 · Process DiscoveryThe malware keeps track of running processes on the compromised host.T1059.007 · JavaScriptThe package's setup.js and second-stage payload are JavaScript used to execute the malware.T1090 · ProxyThe RAT includes a controllable SOCKS5 proxy that can be started and stopped remotely.T1105 · Ingress Tool TransferThe malware retrieves its second-stage payload from the C2 server and can download additional payloads on command.T1115 · Clipboard DataThe persistent payload monitors clipboard contents for patterns matching private keys and other sensitive values.T1195.001 · Compromise Software Dependencies and Development ToolsThe attacker distributed the malware through the malicious @openclaw-ai/openclawai npm package and its postinstall hook.T1539 · Steal Web Session CookieThe malware collects browser cookies and clones browser profiles to access authenticated sessions.T1555.001 · KeychainGhostLoader targets macOS Keychain databases, including login.keychain-db and iCloud Keychain databases.T1555.003 · Credentials from Web BrowsersGhostLoader extracts credentials and other stored data from Chromium-based browsers.T1567.002 · Exfiltration to Cloud StorageThe article reports that stolen data is also exfiltrated through GoFile.io.
People
Malware
Products
Apple Keychainthe package, said it’s designed to steal system credentials, browser data, crypto wallets, SSH keys, Apple Keychain databases, and iMessage history, as well as install a persistent RAT with remote access capabilities,macOSResearchers uncovered a malicious npm package, @openclaw-ai/openclawai, that impersonates an OpenClaw installer to deploy a remote access trojan and exfiltrate sensitive data from macOS hosts.OpenClawResearchers uncovered a malicious npm package, @openclaw-ai/openclawai, that impersonates an OpenClaw installer to deploy a remote access trojan and exfiltrate sensitive data from macOS hosts.