The 'claw-subagent-service' npm package, when installed globally, registers a privileged Windows service running as LocalSystem without prompting the user. This service periodically checks for updates and silently installs newer versions, enabling persistent code execution. It connects to a vendor-controlled RongCloud IM backend to receive remote commands that can execute arbitrary shell scripts and AI-driven commands on the host. Additionally, it continuously exfiltrates session data, project and task metadata, and host identifiers to the vendor backend every 30 seconds. This combination of privileged persistence, silent self-updating, remote command execution, and data exfiltration constitutes a vendor-operated remote administration agent installed via npm, posing a significant security risk if the publisher account or IM backend is compromised.

Compromise of the publisher's npm account or the vendor's IM backend allows attackers to gain immediate, unattended, and persistent privileged code execution on all machines where the package is installed. The attacker can execute arbitrary commands with LocalSystem privileges on Windows or equivalent user privileges on macOS, and continuously exfiltrate sensitive session and host data. This creates a high-risk scenario for remote takeover and data leakage.

No official patch or remediation is indicated. Users should avoid installing or running the 'claw-subagent-service' package globally. If already installed, uninstall the package and remove the associated privileged service. Monitor for and block network connections to the vendor IM backend domain 'newsradar.dreamdt.cn'. Since no patch is available, remediation relies on removal and network controls.