CVE-2026-43569

OpenClaw before 2026.4.9 contains an authentication bypass vulnerability allowing untrusted workspace plugins to be auto-enabled during non-interactive onboarding when provider auth choices are shadowed. Attackers can exploit this by crafting malicious workspace plugins that are automatically...

Malicious code in onboarding-setup-guide (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f460bd48ceadd7fb61e181dbe4b1691bed7bffdf1a8137a52f1b2d90a40914c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5073 Malicious code in onboarding-setup-guide (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f460bd48ceadd7fb61e181dbe4b1691bed7bffdf1a8137a52f1b2d90a40914c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...