GhostClaw Masquerades as OpenClaw in Bid to Plunder Developer Data

A malicious npm package, @openclaw-ai/openclawai, that impersonates the legitimate OpenClaw CLI while quietly deploying a full-featured infostealer and RAT against developers’ machines.

Internally branded “GhostLoader,” this threat combines polished social engineering, encrypted payload delivery, and long‑term persistence to exfiltrate almost every valuable secret a developer holds – from SSH keys and cloud credentials to AI agent configs and live browser sessions.

The package presents as an innocent “OpenClaw Installer” utility, with a clean package.json, a benign src/index.js export, and no listed dependencies, giving it a low‑risk appearance during a quick review.

The real damage starts in the scripts directory, where a postinstall hook silently reinstalls the package globally so the openclaw binary lands on the system PATH and points to scripts/setup.js, the obfuscated first‑stage dropper.​

When developers run openclaw, they see a convincing, animated CLI installer with progress bars and logs, masking the fact that heavily obfuscated code is already reaching out to command‑and‑control (C2) infrastructure.

The JFrog Security research team has identified a live malicious npm package named @openclaw-ai/openclawai.

The script then displays a fake Keychain-style prompt claiming it needs to “securely store credentials,” and asks for the system password, validating each attempt against real OS authentication on macOS, Windows, and Linux to mimic genuine behavior.​

While the victim types their password, setup.js secretly decodes an XOR‑hidden URL and campaign ID, contacts hxxps[://]trackpipe[.]dev, and retrieves an AES‑256‑GCM–encrypted second stage.

The decrypted JavaScript is written to a temporary file, executed in a detached Node process with the stolen password passed via NODE_AUTH_TOKEN and the campaign tag complexarchaeologist1 in NODE_CHANNEL, then wiped after a minute to reduce forensic traces.​

setup.js is heavily obfuscated (string table shuffling, RC4 decoding, control flow flattening). When executed, it displays a convincing fake CLI installer with animated progress bars.

On macOS, if Full Disk Access blocks Safari data, the malware even pops an AppleScript dialog nudging the user to grant Terminal Full Disk Access, complete with a button that opens System Settings, unlocking access to Notes, Mail, iMessage, and Safari history.​

GhostClaw Masquerades as OpenClaw

The second stage, GhostLoader, is an 11,700‑line CommonJS bundle that installs itself as a pseudo “npm telemetry” service at ~/.cache/.npm_telemetry/monitor.js on macOS/Linux or %APPDATA%/.npm_telemetry/monitor.js on Windows and relaunches via shell RC hooks, cron jobs, and background daemons for strong persistence.

It appends disguised “NPM Telemetry Integration Service” lines to .zshrc, .bashrc, and .bash_profile, writes an @reboot cron entry on Linux, and uses a PID lock file to ensure a single, always‑running copy.​

The C2 returns a JSON response with two fields: (base64-encoded encrypted payload) and k (hex decryption key). The payload is decrypted using AES-256-GCM.

On first run, GhostLoader launches a 10‑minute smash‑and‑grab operation, sending a “New Session” alert to Telegram with the victim’s system password, host, IP, country, and specs before mass‑collecting sensitive data.

It loots macOS and iCloud Keychains, decrypts Chromium and Firefox passwords and cookies (leveraging the captured system password on macOS), steals cookies via Chrome DevTools Protocol, and targets popular wallet apps and browser extensions plus BIP‑39 seed phrases found in Desktop, Documents, and Downloads.​

The focus on developers is evident: the malware hunts SSH keys, cloud credentials for AWS, Azure, and GCP, Kubernetes kubeconfig, Docker config, npm and Git credentials, GitHub CLI hosts, Solana keys, and environment variables.

It also looks for AI agent data under ZeroClaw, PicoClaw, and OpenClaw directories, while optionally harvesting FDA‑protected Apple Notes, iMessage chat history, Safari browsing history, and Mail and Apple account databases if Full Disk Access was granted.​

For cookies that resist SQLite extraction, the malware launches headless browser instances using Chrome DevTools Protocol, connecting via -remote-debugging-port to dump all cookies programmatically.

All loot is bundled into a [COUNTRY_CODE]username_persistentId.tar.gz archive and exfiltrated redundantly via direct uploads to trackpipe[.]dev, the Telegram Bot API for smaller archives, and GoFile.io for larger ones using a hardcoded bearer token and password‑locking routine.

A formatted “GhostLoader Report” sent to Telegram then summarizes passwords, cards, autofill entries, wallets, seeds, SSH keys, FDA status, persistence, and AI agent hits for the operator.​

From infostealer to persistent RAT

After the initial raid, GhostLoader switches to a persistent RAT mode on subsequent launches.

It registers with the C2 panel, retrieves Telegram configuration, then spins up multiple monitors, including a clipboard watcher that scans every three seconds for crypto keys, AWS keys, OpenAI and Stripe API keys, mnemonic seeds, and more, forwarding any match in real time.​

The RAT polls the C2 roughly every 25 seconds (with jitter) for commands that let operators execute shell commands, update the payload, re‑run data collection, re‑exfiltrate arbitrary paths, start and stop a SOCKS5 proxy update, and even clone browser profiles.

The CLONE_START command is especially dangerous: it copies a full browser profile, launches a headless Chromium with remote debugging, and relays the CDP WebSocket back to the C2, granting attackers a fully authenticated browsing session as the victim without needing credentials.​

To frustrate defenders, GhostLoader uses detached processes with innocuous process titles, wipes temp payloads, hides under .npm_telemetry names and comment banners, cleans its loot directory after exfiltration, and exposes a NUKE command that removes hooks, cron jobs, temp files, and the install directory to self‑destruct on demand.​

JFrog reports that @openclaw-ai/openclawai is already blocked by JFrog Xray and JFrog Curation, reducing exposure for organizations using their software supply chain security stack.

Organizations are advised to rely on official OpenClaw distributions from verified sources and to deploy automated curation and SCA tools that can spot malicious install‑time behaviors before they reach developer endpoints.

Developers who installed the package should aggressively clean persistence (shell RC files, zshenv/profile, cron), kill npm_telemetry / monitor.js processes, delete the .npm_telemetry directory, uninstall the package, and strongly consider a full re‑image given the depth of compromise.

Because GhostClaw weaponizes trust in development tooling, teams should treat any npm package that requests system passwords, uses postinstall hooks to install itself globally, or fetches remote encrypted payloads at install time as a red flag.

Indicators of Compromise

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.