GhostClaw Mimic as OpenClaw to Steal Everything from Developers

**Executive Summary:** A malicious npm package named @openclaw-ai/openclawai (tracked as GhostClaw / internally GhostLoader) disguised as an installer to socially engineer developer credentials, persist on macOS, Linux, and Windows systems, and deploy a multi-stage infostealer that harvests system passwords, macOS Keychain, cloud credentials (AWS/GCP/Azure), SSH keys, browser-saved credentials and cards, BIP-39 crypto seed phrases, and iMessage data; JFrog researchers attribute the discovery to active registry monitoring and recommend removal of the .npm_telemetry directory, shell cleanup, credential rotation, session revocation, and full system re-image where appropriate.