GhostClaw AI Assisted Malware Attacking macOS Users to Deploy Credential-Stealing Payloads

GhostClaw is an active macOS-focused malware campaign spreading through malicious npm packages and impersonating GitHub repositories (including AI-agent-triggering SKILL.md files) to harvest credentials and install persistent JavaScript payloads; it leverages user social engineering, automated developer tooling, obfuscated installers, insecure downloads, and C2 retrieval (trackpipe.dev) to scale infections across developer ecosystems.