TGTGInsighttelegram intelligenceLIVE / telegram public index
TGINSIGHT POST
Post #8561
@thehackernews
The Hacker News
Post content
Post content
⚠️ A malicious npm package is spreading a full RAT malware disguised as an OpenClaw installer. It pulls a hidden second-stage payload and steals browser data, macOS Keychain entries, crypto wallets, and developer cloud credentials. 🔗 Read → https://thehackernews.com/2026/03/malicious-npm-package-posing-as.html