If you run OpenClaw, this week’s news matters to you. Security researchers are tracking a supply-chain campaign called ClawHavoc that plants malware on machines through fake OpenClaw packages and poisoned skills. The malware, a stealer called NovaStealer, has already hit more than 60 crypto wallets and lifted SSH keys and AWS credentials from victim machines.
Here is the uncomfortable part: the attack does not need you to click a sketchy link. In several reported cases, the victim’s own agent helped install the malware. A poisoned skill told the agent to walk the user through pasting an “install command” into a terminal, and the agent did it willingly because the instructions looked legitimate.
The good news: checking your OpenClaw install for ClawHavoc is fast. This guide shows you exactly what to look for, how to audit your skills and plugins in about 10 minutes, and how to lock things down so it cannot happen again.
What Is ClawHavoc and Why Is It Spreading Now
ClawHavoc is the name researchers gave to a malicious package campaign targeting the OpenClaw ecosystem. Attackers uploaded packages to package registries that impersonate legitimate OpenClaw tools, using typosquatted names like clawhub-cli, clawhubb, and openclawcli. The names are one or two characters off from the real tools, which is exactly how people end up installing the wrong package by accident.
Once installed, the package drops NovaStealer, a data-stealing payload. It targets browser passwords, saved payment data, crypto wallet files and seed phrases, SSH private keys, and cloud credentials such as AWS keys. Everything it finds gets shipped back to the attacker.
This is not the first scare in the OpenClaw ecosystem. Earlier this year, researchers reported that a meaningful share of public skills in the ClawHub registry contained malicious or suspicious code, and multiple CVEs have been disclosed against OpenClaw itself, including a remote code execution flaw fixed in early releases. ClawHavoc is different because it combines typosquatting with social engineering that abuses the agent’s own trust.
How the Attack Works: Your Agent Becomes the Installer
The ClawHavoc campaign is a two-stage attack, and stage two is what makes it dangerous.
Stage 1: The poisoned package or skill
You install what looks like a useful automation tool, a crypto helper, or a developer utility. The package name is close enough to the real thing that nothing feels off. The code looks professional, and the documentation is polished. But hidden inside is an installer for NovaStealer, plus instructions designed for AI agents.
Stage 2: The agent is tricked into helping
Here is the clever and nasty part. The malicious skill contains instructions written to be followed by an AI agent, not a human. When you ask your agent to use the “tool,” the skill instructs the agent to tell you that a prerequisite component is missing and that you should install it by pasting a command into your terminal. The command downloads and runs the stealer.
Because the instruction comes from a skill the agent treats as trusted tooling, and because it is framed as a normal setup step, the agent passes it along without suspicion. To the human, it looks like the agent found the official fix. To the attacker, it is a malware delivery channel with a trusted voice.
The 10-Minute ClawHavoc Self-Check
You do not need to be a security expert to check your install. Work through these four checks. If anything looks wrong, skip to the cleanup section below.
Check 1: List your installed skills and plugins
Start by listing everything your agent can load:
openclaw skills list
openclaw plugins listGo through the list line by line. Flag anything you do not remember installing, anything with a name that looks slightly off (extra letters, swapped characters, odd suffixes), and anything described as a “crypto helper,” “wallet tool,” or “prerelease utility.”
Check 2: Verify package names against the official registry
The known ClawHavoc packages are clawhub-cli, clawhubb, and openclawcli, but new names appear as the campaign evolves. Compare every installed package against the official ClawHub registry and the official OpenClaw GitHub repository. If the package you installed is not listed in the official source, treat it as suspicious and remove it.
Check 3: Look for recently modified config and startup files
Stealers often add persistence by modifying shell profiles, startup scripts, or the OpenClaw config directory. On macOS and Linux, check these files for anything new:
ls -la ~/.zshrc ~/.bashrc ~/.profile ~/.openclaw
cat ~/.zshrc | grep -i -E "curl|wget|python|node" | head -20You are looking for download-and-run commands (curl or wget piped into bash or python) that you did not add yourself. Legitimate setup scripts exist, but a line that downloads from a random-looking domain is a red flag.
Check 4: Review recent agent history for suspicious instructions
Open your recent session history and look for any turn where the agent suggested running an install command, downloading a file, or granting a new permission out of nowhere. The ClawHavoc skills instruct agents to ask users to paste commands. If you see that pattern in your history, treat it as a potential infection even if you do not remember running the command.
What to Do If You Find Something Suspicious
If any check comes back positive, do not panic. Do these in order:
- Disconnect the machine from the network. Cut Wi-Fi or unplug Ethernet before doing anything else. This stops NovaStealer from exfiltrating more data while you work.
- Remove the suspicious skill or plugin. Use
openclaw skills remove [name]andopenclaw plugins remove [name], then delete the package from your system package manager. - Rotate everything that matters. Change passwords, rotate AWS keys and SSH keys, and move any funds out of software wallets that were open on the machine. Assume anything on that machine was exposed.
- Scan with a real malware scanner. Run a full system scan. NovaStealer is a known signature now, so modern scanners should detect it.
- Restore from a clean backup if you have one. If your agent data is backed up and you have a restore point from before the infection, use it after confirming the backup itself is clean.
How to Prevent This From Happening Again
Prevention is mostly about habits, and the good news is these habits take minutes to build.
Only install skills and plugins from the official registry
Install directly through ClawHub’s official catalog or the official OpenClaw repository, and verify the publisher name before installing. If a tutorial tells you to install from a random GitHub repo or a bare npm command, check the package name against the official source first.
Read what a skill actually does before you install it
Skills are just code plus instructions. Before installing, open the skill’s manifest and skim its main files. You are looking for anything that downloads files, reads credential files, touches wallet directories, or sends data to external domains. A skill that needs to run curl commands as part of normal operation is a skill to avoid.
Keep your agent on a tight permission leash
Do not give your agent blanket approval for installs and shell commands. Use OpenClaw’s approval flow for sensitive actions, keep exec permissions scoped to what you actually use, and never let a skill dictate terminal commands to you without verifying them yourself. If your agent says “paste this command,” stop and read the command first.
Update OpenClaw and use the new security features
The latest OpenClaw releases added stronger secret egress protection, which binds secrets to exact destination hosts so unbound secret substitution fails closed before data leaves the machine. Update to the newest stable release and enable the security features in your gateway config. Recent high-severity advisories like CVE-2026-33579 are already fixed in current stable builds, so staying current closes real holes. Also enable SQLite snapshot backups so you can roll back to a clean state quickly if something goes wrong.
Keep credentials out of plain sight
Do not keep AWS keys, SSH private keys, or wallet seed phrases in files your agent can read freely. Use environment variables or a secrets manager, and scope each key to the minimum permissions it needs. A stealer cannot steal what is not on the machine.
The Bottom Line
Want the full OpenClaw security checklist?
If you are new to OpenClaw or setting up a fresh machine, start with the setup guide and lock down permissions before you install anything from the registry.
ClawHavoc is real, it is active right now, and it abuses the one thing people trust most about their agents: that the agent would never suggest something harmful. The fix is not to stop using agents. The fix is to treat skills and plugins like any other software, verify before installing, and keep credentials locked down.
Run the 10-minute self-check today. If you find nothing, you bought peace of mind for the cost of a coffee break. If you find something, you just saved yourself a very bad week.
About The Author
