Supply Chain NPM Claw Orchestrator Delivery

How the attack works

An attacker publishes or tricks a developer into installing a package under a name closely matching a legitimate-sounding 'Claw Orchestrator' tool. The victim runs a package-manager command (like npm install) naming that package, or later executes a binary with that name, often in a context tied to an AI-agent integration point such as an MCP host configuration. The rule fires when it sees both a fetch/exec verb and the package name (or an MCP-host target) in the same command line. It does not observe what the package does after that point — no network activity, no further capability changes — because those signals aren't available to it.

Netzilo detection

Why it matters

If the package is malicious, an attacker gains code execution inside a developer's environment or inside an AI-agent tool's configuration surface, potentially enabling further compromise (credential theft, further supply-chain tampering, agent hijacking). This rule only proves the package was pulled in or run; it does not confirm compromise occurred.

What you can do

• →Treat any hit as an investigation trigger, not a verdict — inspect the actual package source and registry metadata before deciding it's malicious.
• →Verify whether the package is a legitimate internal tool published under a similar name or scope (e.g. @claw/*); check registry, publisher identity and integrity hash.
• →Review MCP/agent host configs (Claude Desktop, Cursor, Cline, Continue, Windsurf, Roo) for unexpected package references or newly added integrations.
• →Pin and audit lockfiles so a removed or blocked package can't silently reappear via a stale lockfile in CI.

Known benign look-alikes

• Security responder or malware analyst deliberately installing the package in a sandbox to triage it. The read-only forms (npm view/info/audit/pack) and --dry-run are filtered; a real install is intentionally still reported, because an analyst pulling it onto a developer workstation is exactly the event worth seeing.
• An internal or first-party package that legitimately uses the name "claw-orchestrator" or the "@claw/*" scope. Confirm the registry, publisher and integrity hash before dismissing.
• CI or dependency-hygiene runs that reinstall from a historical lockfile which still pins the package while it is being removed from the tree.
• A shell wrapper that echoes the install command before running it (echo/printf chains are not filtered, only pager and grep style argv[0]).
• Generic orchestration CLIs invoked with --mcp flags that happen to match the binary-name variant; requires both the name and the MCP target, so this needs the tool to actually be named claw-orchestrator.

References

• https://attack.mitre.org/techniques/T1195/002/
• https://attack.mitre.org/techniques/T1204/002/
• https://genai.owasp.org/llmrisk/llm032025-supply-chain/
• https://atlas.mitre.org/techniques/AML.T0010

Related threats