A malicious package named openclaw-installer was recently discovered on the npm registry targeting developers by mimicking a legitimate installer for the OpenClaw game engine.

Attack Details

The package was designed to infect macOS systems with a Remote Access Trojan (RAT) and credential-stealing malware.

• Deceptive Tactics: The attackers used typosquatting and social engineering, making the package look like a helpful utility for OpenClaw.
• Malicious Payload: Once installed, the package executes a script that downloads a second-stage payload. This payload is a Go-based RAT capable of:
  • Credential Theft: Specifically targeting the macOS Keychain to steal saved passwords and keys.
  • Data Exfiltration: Capturing system metadata, browser history, and session cookies.
  • Remote Command Execution: Allowing the attackers to maintain persistence and run arbitrary code on the infected machine.
• Discovery: Cybersecurity researchers at Phylum identified the package and reported it to the npm security team, leading to its removal.

How to Protect Your Environment

If you or your team use open-source game engine tools, take these precautions:

• Verify Package Sources: Always cross-reference the official GitHub repository or website before running an installer from a package manager.
• Check Install Scripts: Be wary of packages that use preinstall or postinstall scripts to download external binaries.
• Audit npm History: If you accidentally downloaded openclaw-installer, assume the system is compromised and rotate all credentials stored in your macOS Keychain.