GhostLoader
-
Malicious npm package posing as OpenClaw installer deploys RAT, steals credentials
A JFrog technical analysis reported a malicious npm package posing as an OpenClaw installer. Uploaded March 3, 2026, the package installs a RAT and steals credentials, browser data, wallets and other sensitive macOS data.
