Scan to download
BTC $77,054.34 -1.61%
ETH $2,294.96 -3.13%
BNB $624.01 -1.84%
XRP $1.39 -2.57%
SOL $84.29 -2.82%
TRX $0.3259 +0.73%
DOGE $0.0980 -1.34%
ADA $0.2461 -2.57%
BCH $448.80 -1.25%
LINK $9.22 -2.74%
HYPE $41.62 -0.88%
AAVE $96.10 -0.81%
SUI $0.9246 -2.48%
XLM $0.1646 -3.85%
ZEC $353.23 -2.03%
BTC $77,054.34 -1.61%
ETH $2,294.96 -3.13%
BNB $624.01 -1.84%
XRP $1.39 -2.57%
SOL $84.29 -2.82%
TRX $0.3259 +0.73%
DOGE $0.0980 -1.34%
ADA $0.2461 -2.57%
BCH $448.80 -1.25%
LINK $9.22 -2.74%
HYPE $41.62 -0.88%
AAVE $96.10 -0.81%
SUI $0.9246 -2.48%
XLM $0.1646 -3.85%
ZEC $353.23 -2.03%

check

Slow Fog: Pay attention to checking for malicious versions of axios and the exposure risk of global installation history for OpenClaw npm

Slow Fog has once again issued a security reminder stating to pay attention to checking for malicious versions of axios and the exposure risk of OpenClaw npm global installation history. axios@1.14.1 and axios@0.3.4 have been confirmed as malicious versions, both of which have injected the dependency plain-crypto-js@4.2.1, delivering cross-platform malicious payloads through the postinstall script.The impact of OpenClaw is assessed based on scenarios: source code builds are not affected, as the locked versions in the lock file are 1.13.5/1.13.6; however, users who installed via npm install -g openclaw@2026.3.28 face historical exposure risks due to the presence of optionalDependencies.axios@^1.7.4 in the dependency chain, which may resolve to axios@1.14.1 during the time window when the malicious version is still online. Currently, npm has reverted the resolution to axios@1.14.0, but environments that were installed during the attack window are still advised to be checked. Slow Fog has provided inspection commands and IoC paths for various platforms; if the plain-crypto-js directory is found, even if the package.json has been cleaned, it should still be regarded as high-risk execution traces. It is recommended that affected hosts immediately rotate credentials and conduct host-side inspections. Previously, Slow Fog founder Yu Xian reminded that OpenClaw version 3.28 may introduce a toxic version of axios, and users need to urgently check.
app_icon
ChainCatcher Building the Web3 world with innovations.