Skip to main content
MalwarePublished Updated

claw-subagent-service (npm) · Malicious Code

Affects claw-subagent-serviceSource GCVE Database

0

Malicious package : remove claw-subagent-service and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 23:33 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-3757

What to do

Remove claw-subagent-service from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

ProductAffectedFixed in
npmclaw-subagent-serviceAffected
  • 0.0.80 – 1.4.0
35 affected builds		Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'claw-subagent-service' installs a privileged Windows service that runs as LocalSystem without user consent. It establishes a persistent remote-control channel via a vendor-controlled IM backend, enabling arbitrary command execution and continuous data exfiltration from the host. The service self-updates silently every six hours, fetching and executing new versions with elevated privileges. This behavior creates a vendor-operated remote administration agent with persistent privileged access on affected machines.

References

Community reviews

Loading reviews…