GLOBAL SITUATIONMONITORING
517 published briefsUTCFri, Oct 23 17:09:32
-
Malicious npm package posing as OpenClaw installer deploys RAT, steals macOS credentials
Researchers say a malicious npm package named @openclaw-ai/openclawai masqueraded as an OpenClaw installer, deployed a remote access trojan, and stole sensitive data from macOS systems after being uploaded by a user named openclaw-ai on March 3, 2026.
-
ClawJacked: New OpenClaw Flaw Lets Malicious Websites Hijack Local AI Agents
A new “ClawJacked” flaw in OpenClaw lets malicious websites silently hijack local AI agents via WebSockets. Here is how it works and how to defend.