🛡️ MAL-2026-3757 — claw-subagent-service

Malicious code in claw-subagent-service (npm)

Source: amazon-inspector

On npm install -g, the package's scripts/post-install.js registers a privileged Windows service claw-subagent-service pointing at service/daemon.js, configured with sc.exe failure... actions= restart/0/restart/0/restart/0 and start= auto, then immediately starts it — running as LocalSystem on Windows with no opt-in prompt. Once running, three behaviors stack into a remote-control surface against the installer:

1. Self-replacing update channel (service/updater.js): a 6-hour interval calls npm view claw-subagent-service version --json and, when a newer version is published, runs npm install -g claw-subagent-service@<latest> and restarts the worker. Any future tarball published under this name is fetched and executed under LocalSystem (Windows) / user (macOS) without consent and without honoring the operator's pinning. Linux is gated, Windows + macOS are not.

2. Vendor-controlled IM command channel (service/worker.js, service/modules/rongyun-message-handler.js, service/modules/script-executor.js, service/rongcloud/openclaw-client.js): the worker fetches a token from https://newsradar.dreamdt.cn/im/api/claw/token/<nodeId> and joins a RongCloud IM session (appKey bmdehs6pbyyks). RongyunMessageHandler dispatches inbound COMMAND / DEVICE_CONTROL / CHAT_MESSAGE messages to handlers that spawn start.sh/stop.sh/restart.sh/status.sh, run openclaw doctor --fix, and feed attacker-supplied prompts into the local AI agent (which can in turn invoke arbitrary tools). Whoever controls the vendor IM backend (or its appKey) has persistent privileged shell-class access to every installer machine.

3. Continuous data exfiltration (service/modules/heartbeat-dashboard.js, service/modules/dashboard-collector.js): every 30 seconds the worker reads ~/.openclaw/agents/*/sessions/*.jsonl, ~/.openclaw/projects/projects.json, ~/.openclaw/tasks/tasks.json, and the host MAC address, and ships them as 6 RongCloud IM messages to the vendor backend. Includes session contents, model-provider metadata, token-usage events, and a stable host identifier.

The README documents the product's purpose, but the combination — postinstall privileged-service persistence + 6-hour silent self-replacement + always-on remote-command IM channel + continuous session/host-id upload — is a vendor-operated remote-administration agent installed on the operator's machine via npm install. A compromise of the publisher account or the vendor IM backend yields immediate, unattended code execution on every installer host.