Five malicious Rust crates published to crates.io between late February and early March impersonate time-related utilities to steal .env files and developer secrets from CI/CD pipelines. The packages use typosquatting tactics to masquerade as legitimate time APIs and are distributed via an AI bot.
A malicious npm package (@openclaw-ai/openclawai) impersonating OpenClaw installer was discovered deploying a RAT and stealing macOS credentials. The package was uploaded March 3, 2026 and downloaded 178 times before discovery.
Three malicious PHP packages on Packagist disguised as Laravel utilities were discovered distributing a cross-platform remote access trojan (RAT) capable of compromising Windows, macOS, and Linux systems. The packages—lara-helper, simple-queue, and lara-swagger—achieved limited distribution (29-49 downloads each) before being flagged by security researchers.