GhostClaw Supply Chain Campaign: Malicious GitHub Repos and AI Workflow SKILL.md Files Deliver GhostLoader macOS Infostealer via trackpipe[.]dev C2
GhostClaw Supply Chain Campaign (TL-2026-0255), also tracked as GhostClaw, is a high-severity malware campaign scored CVSS 8.1, first published 2026-03-20. It is attributed to GhostClaw Operator with low confidence, affects Apple macOS, maps to 24 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-0255
- Threat ID
- TL-2026-0255
- Also known as
- GhostClaw, GhostLoader, complexarchaeologist1
- Severity
- HIGH
- CVSS
- 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
- Status
- MONITORING
- Category
- MALWARE
- First published
- 2026-03-20
- Last reviewed
- 2026-03-20
- Attribution
- GhostClaw Operator
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, cryptocurrency, fintech, artificial-intelligence, open-source
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in GhostClaw Supply Chain Campaign
Malware and tooling: GhostClaw, GhostLoader, GhostLoader C2 Panel
GhostClaw is an active supply chain campaign distributing the GhostLoader RAT through malicious GitHub repositories and npm packages disguised as legitimate developer tools. The attack chain uses curl|bash install scripts and AI workflow SKILL.md files to deliver a multi-stage credential stealer and RAT targeting macOS, Linux, and Windows developers, exfiltrating credentials, crypto wallets, SSH keys, browser data, and cloud tokens to the trackpipe[.]dev C2 infrastructure.
How GhostClaw Supply Chain Campaign works
GhostClaw represents a sophisticated, multi-vector supply chain attack targeting software developers across macOS, Linux, and Windows platforms. First identified by JFrog Security Research on March 8, 2026, and further analyzed by Jamf Threat Labs on March 20, 2026, the campaign operates through two primary infection vectors: malicious GitHub repositories with curl|bash install scripts, and AI agent workflow exploitation via SKILL.md files compatible with OpenClaw and similar AI coding assistants.
The campaign maintains at least 10 malicious GitHub repositories impersonating legitimate tools including trading bots (TradingView-Claw, poly-market-kalshi-bot), developer SDKs (antigravity-sdk, xcode-claw), AI integrations (Claude-Zeroclaw, Doubao-Claw), and utilities (Bunkr-Downloader-Python). Some repositories accumulated hundreds of stars before payload injection, suggesting either social engineering or algorithmic manipulation.
The infection chain begins with an install.sh bootstrap script that downloads Node.js with disabled TLS verification (curl -fSLk), then executes setup.js which displays fake progress indicators mimicking legitimate SDK installation. The dropper prompts for system credentials via spoofed terminal prompts or AppleScript dialogs, validating stolen passwords against the actual OS using dscl (macOS), su (Linux), or PowerShell ValidateCredentials (Windows). Credentials are passed to subsequent stages via the NODE_AUTH_TOKEN environment variable.
The secondary payload is GhostLoader, an 11,700-line encrypted JavaScript framework retrieved from trackpipe[.]dev C2 using AES-256-GCM encryption. It installs to ~/.cache/.npm_telemetry/monitor.js (macOS/Linux) or %APPDATA%/.npm_telemetry/monitor.js (Windows), mimicking legitimate npm telemetry. Persistence is achieved through shell hooks appended to .zshrc/.bashrc/.bash_profile and crontab entries on Linux.
GhostLoader provides comprehensive RAT capabilities: credential harvesting from browsers (Chrome, Brave, Edge, Firefox, Opera, Vivaldi, Yandex), macOS Keychain databases, crypto wallets (Exodus, Electrum, Atomic, MetaMask, Phantom, Solflare), SSH keys, cloud credentials (AWS, Azure, GCP, Kubernetes), and developer tokens (npm, Git, GitHub CLI). It monitors clipboards every 3 seconds for cryptocurrency addresses and private keys. Full Disk Access exploitation via AppleScript enables harvesting of Apple Notes, iMessage chat.db, and Safari history.
C2 communication polls trackpipe[.]dev every ~25 seconds with 30% jitter, supporting commands including EXEC (shell execution), GRAB (file exfiltration), CLONE_START (headless browser session cloning via Chrome DevTools Protocol), PROXY_START (SOCKS5 proxy), UPDATE (self-update), and NUKE (self-destruct with evidence cleanup). Exfiltration uses three channels: direct upload to trackpipe[.]dev, Telegram Bot API for archives under 49MB, and GoFile.io for larger archives.
The npm package @openclaw-ai/openclawai (versions 1.5.14-1.5.15) bridges GitHub and npm distribution, with postinstall hooks creating redundant infection paths. Campaign segmentation uses unique UUIDs per repository variant and NODE_CHANNEL environment variables (anglmf, cryptoexth4) suggesting operational separation across lure categories.
MITRE ATT&CK techniques used in TL-2026-0255
collection
T1005 Data from Local System; T1056 Input Capture; T1115 Clipboard Data; T1560 Archive Collected Data
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information
exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1204 User Execution
command-and-control
T1071 Application Layer Protocol; T1090 Proxy; T1573 Encrypted Channel
initial-access
T1195 Supply Chain Compromise; T1566 Phishing
privilege-escalation
T1546 Event Triggered Execution
persistence
T1547 Boot or Logon Autostart Execution
credential-access
T1552 Unsecured Credentials; T1555 Credentials from Password Stores
resource-development
Affected products and versions in GhostClaw Supply Chain Campaign
- Apple — macOS
Vulnerable versions: All versions with Node.js support - Linux Foundation — Linux
Vulnerable versions: All distributions with Node.js support - Microsoft — Windows
Vulnerable versions: All versions with Node.js support - npm — @openclaw-ai/openclawai
Vulnerable versions: 1.5.14; 1.5.15
Remediation for GhostClaw Supply Chain Campaign
Immediate actions
- Block trackpipe[.]dev at DNS and proxy level
- Search for ~/.cache/.npm_telemetry/ directory on all developer workstations
- Audit shell profiles (.zshrc, .bashrc, .bash_profile) for NPM Telemetry Integration Service hooks
- Check crontab for Node.js Telemetry Collection entries on Linux systems
- Remove malicious npm package @openclaw-ai/openclawai if installed
- Block Telegram Bot API and GoFile.io uploads from developer machines if not business-required
Workarounds
- Do not execute curl|bash commands from untrusted GitHub repositories
- Verify repository ownership, commit history, and star authenticity before installation
- Reject any SDK installation that requests system password via terminal prompt
- Use virtual environments or containers for untrusted package evaluation
Longer-term hardening
- Implement npm package allowlisting and audit postinstall hooks before installation
- Deploy EDR with behavioral detection for credential prompt spoofing and dscl -authonly abuse
- Enforce code signing and notarization requirements for all developer tools
- Monitor for anomalous Node.js processes with NODE_AUTH_TOKEN or GHOST_* environment variables
- Implement network monitoring for C2 polling patterns (~25 second intervals with jitter)
- Audit AI agent workflow configurations (SKILL.md files) before execution
- Deploy clipboard monitoring detection for crypto address swapping patterns
Weaknesses (CWE) in GhostClaw Supply Chain Campaign
CWE-506, CWE-494, CWE-327
Timeline of GhostClaw Supply Chain Campaign
- Earliest malicious GitHub repositories staged with benign code to build credibility and accumulate stars before payload injection
- Malicious npm package @openclaw-ai/openclawai versions 1.5.14-1.5.15 published to npm registry with postinstall hooks deploying GhostLoader
- Campaign expands to 10+ GitHub repositories across multiple lure categories including trading bots, SDKs, AI integrations, and gaming tools
- SKILL.md files added to repositories targeting AI coding agent workflows (OpenClaw, ZeroClaw, PicoClaw), enabling infection without direct user interaction
- JFrog publishes detailed technical analysis of GhostClaw/GhostLoader attack chain, encryption methods, and full RAT capabilities
- JFrog Security Research identifies malicious @openclaw-ai/openclawai package during automated npm registry monitoring, assigns XRAY-949975
- Wide industry coverage from The Hacker News, CSO Online, eSecurity Planet, CyberSecurity News, and ThaiCERT advisory published
- trackpipe[.]dev C2 infrastructure confirmed still active, serving encrypted payloads and accepting exfiltrated data
- Jamf Threat Labs publishes extended analysis identifying 8+ new GitHub-distributed samples, AI workflow exploitation vector, and additional operator accounts
- As of 2026-05-29, GhostClaw remains a live threat: the malicious npm package was pulled Mar 10 (~178 victims), but Jamf confirmed the campaign expanded to 8+ GitHub repos, AI-workflow SKILL.md lures, and trackpipe[.]dev C2 (active Mar 15) with no public takedown. No CVE/KEV applies; the operator is unattributed and undisrupted (May takedowns hit Glassworm, not GhostClaw), so the multi-vector infostealer warrants continued monitoring.
Sources cited for GhostClaw Supply Chain Campaign
- Jamf Threat Labs: GhostClaw Expands Beyond npm to GitHub Repositories and AI Workflows
- JFrog Security Research: GhostClaw Unmasked - Malicious npm Package Impersonating OpenClaw
- The Hacker News: Malicious npm Package Posing as OpenClaw Installer Deploys RAT
- CSO Online: Devs Looking for OpenClaw Get Served a GhostClaw RAT
- eSecurity Planet: Fake OpenClaw npm Package Installs GhostClaw Malware
- CyberSecurity News: GhostClaw Mimic as OpenClaw to Steal Everything from Developers
- GBHackers: GhostClaw Masquerades as OpenClaw in Bid to Plunder Developer Data
- SOCRadar: GhostLoader Malware Spreads Through Fake OpenClaw npm Package
- ThaiCERT Advisory: Malicious npm Package OpenClaw Distributes GhostLoader
Threats related to GhostClaw Supply Chain Campaign
- Leaked Shai-Hulud Source Code Fuels New npm Infostealer + DDoS Botnet Campaign (deadcode09284814, May 2026)
- Void Dokkaebi (Famous Chollima) Cython-Compiled InvisibleFerret — .pyd/.so Binary Evasion of Script-Based Detections (DPRK Contagious Interview)
- GlassWorm Supply Chain Attack: Fake Browser Extension & Multi-Stage RAT via Compromised Developer Packages
- Contagious Interview: DPRK Campaign Delivers OtterCookie and FlexibleFerret Backdoors via Fake Developer Job Interviews
- WeedHack MaaS Campaign: Minecraft Fake Mod Loader with RSA-Signed Blockchain C2 (LoaderClient)
Detection coverage for TL-2026-0255
As of 2026-03-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0255 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.