OpenSSF/OSV advisory MAL-2026-13367 confirms this npm version as malicious. The package's cli.js imports child_process, https, and os, reads process.env and system information (via os.tmpdir and related os APIs), spawns a bash subprocess, and issues outbound https.get requests...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in clawtrl-wallet (npm)
Details
The package's cli.js imports child_process, https, and os, reads process.env and system information (via os.tmpdir and related os APIs), spawns a bash subprocess, and issues outbound https.get requests. The composition — environment/system-data read paired with a bash spawn and outbound HTTPS from a wallet-branded npm package — matches the credential/wallet-stealer shape rather than any legitimate wallet library behavior. Wallet packages have no need to shell out to bash or transmit environment contents off-host, and the package name suggests impersonation of a wallet utility to lure installers.
Decision reason
No blocking static signals were detected.