CVE-2026-35641

OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a .npmrc file with a git executable override. During npm install execution in the staged package directory, attackers can leverage git dependencies to trigger execution of arbitrary programs specified in the attacker-controlled .npmrc configuration file.

OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a .npmrc file with a git executable override. During npm install execution in the staged package directory, attackers can leverage git dependencies to trigger execution of arbitrary programs specified in the attacker-controlled .npmrc configuration file.

Fixed in OpenClaw 2026.3.24, the current shipping release.

Summary

During the installation phase of OpenClaw local plugins/hooks, the Git executable can be hijacked by a project-level .npmrc file, leading to arbitrary code execution during installation.

Details

Please note that the source code locations mentioned below are based on version openclaw-2026.3.13-1, but the issue has been confirmed to still exist in the current latest version, 2026.3.23.

When installing a local plugin directory, local plugin archive, local hook pack directory, or local hook pack archive, OpenClaw first copies the source directory to a temporary stageDir, then executes the following in that directory:

npm install --omit=dev --silent --ignore-scripts

See src/infra/install-package-dir.ts:176-199.

Since this process does not strip the project root .npmrc, and npm reads the project-level .npmrc during local project installation, an attacker could use a .npmrc file in a malicious plugin or hook directory to override npm’s git executable path. By leveraging a Git dependency, the attacker could trigger npm to call this malicious program, thereby executing arbitrary local code during the installation phase.

Affected Paths

• Plugin CLI entry point: src/cli/plugins-cli.ts:199-255
• Hook CLI entry point: src/cli/hooks-cli.ts:573-676
• Plugin local directory / archive installation: src/plugins/install.ts:379-405, src/plugins/install.ts:541-565
• Hook local directory / archive installation: src/hooks/install.ts:380-403, src/hooks/install.ts:443-470
• Actual execution of npm install --ignore-scripts: src/infra/install-package-dir.ts:176-199

Vulnerability Trigger Flow

1. The user executes one of the following commands:

   • openclaw plugins install <path-or-spec>
   • openclaw hooks install <path-or-spec>

2. If the argument is a local directory or local archive, OpenClaw navigates to the local installation path.

3. OpenClaw copies the source directory to a temporary stageDir. See src/infra/install-package-dir.ts:176-177.

4. If dependencies are present in package.json, OpenClaw executes the following in stageDir:

npm install --omit=dev --silent --ignore-scripts

See src/infra/install-package-dir.ts:188-199.

5. npm reads the project-level .npmrc file in this directory. Official documentation: .npmrc
6. If .npmrc is set to git=<path to malicious program> and there is a git dependency in the dependency tree, npm will invoke that git program when resolving the dependency. Official documentation: npm config git Git dependency documentation: package.json
7. Consequently, an attacker can execute arbitrary local programs during the plugin/hook installation phase without waiting for the plugin or hook to be loaded later.

Triggering Commands

• Plugin installation command:

openclaw plugins install <path-or-spec>

• Hook installation command:

openclaw hooks install <path-or-spec>

When <path-or-spec> is a local directory or local archive, it will be resolved to the path used by the npm install --omit=dev --silent --ignore-scripts command mentioned above.

PoC

Currently, testpoc/ is a minimal PoC directory used to verify that “when installing local packages, OpenClaw enters the npm install --ignore-scripts path.” It is divided into two core sections:

testpoc/pkg/ Purpose: Simulates the local package directory installed by openclaw plugins install ... or openclaw hooks install ... testpoc/repo/ Purpose: Simulates a Git dependency repository within the npm dependency tree Directory Structure

testpoc/ ├─ pkg/ │ ├─ .npmrc │ ├─ package.json │ └─ sample-hook/ │ ├─ HOOK.md │ └─ handler.js └─ repo/ ├─…

OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a .npmrc file with a git executable override. During npm install execution in the staged package directory, attackers can leverage git dependencies to trigger execution of arbitrary programs specified in the attacker-controlled .npmrc configuration file.

OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a .npmrc file with a git executable override. During npm install execution in the staged package directory, attackers can leverage git dependencies to trigger execution of arbitrary programs specified in the attacker-controlled .npmrc configuration file.

Fixed in OpenClaw 2026.3.24, the current shipping release.

Summary

During the installation phase of OpenClaw local plugins/hooks, the Git executable can be hijacked by a project-level .npmrc file, leading to arbitrary code execution during installation.

Details

Please note that the source code locations mentioned below are based on version openclaw-2026.3.13-1, but the issue has been confirmed to still exist in the current latest version, 2026.3.23.

When installing a local plugin directory, local plugin archive, local hook pack directory, or local hook pack archive, OpenClaw first copies the source directory to a temporary stageDir, then executes the following in that directory:

npm install --omit=dev --silent --ignore-scripts

See src/infra/install-package-dir.ts:176-199.

Since this process does not strip the project root .npmrc, and npm reads the project-level .npmrc during local project installation, an attacker could use a .npmrc file in a malicious plugin or hook directory to override npm’s git executable path. By leveraging a Git dependency, the attacker could trigger npm to call this malicious program, thereby executing arbitrary local code during the installation phase.

Affected Paths

• Plugin CLI entry point: src/cli/plugins-cli.ts:199-255
• Hook CLI entry point: src/cli/hooks-cli.ts:573-676
• Plugin local directory / archive installation: src/plugins/install.ts:379-405, src/plugins/install.ts:541-565
• Hook local directory / archive installation: src/hooks/install.ts:380-403, src/hooks/install.ts:443-470
• Actual execution of npm install --ignore-scripts: src/infra/install-package-dir.ts:176-199

Vulnerability Trigger Flow

1. The user executes one of the following commands:

   • openclaw plugins install <path-or-spec>
   • openclaw hooks install <path-or-spec>

2. If the argument is a local directory or local archive, OpenClaw navigates to the local installation path.

3. OpenClaw copies the source directory to a temporary stageDir. See src/infra/install-package-dir.ts:176-177.

4. If dependencies are present in package.json, OpenClaw executes the following in stageDir:

npm install --omit=dev --silent --ignore-scripts

See src/infra/install-package-dir.ts:188-199.

5. npm reads the project-level .npmrc file in this directory. Official documentation: .npmrc
6. If .npmrc is set to git=<path to malicious program> and there is a git dependency in the dependency tree, npm will invoke that git program when resolving the dependency. Official documentation: npm config git Git dependency documentation: package.json
7. Consequently, an attacker can execute arbitrary local programs during the plugin/hook installation phase without waiting for the plugin or hook to be loaded later.

Triggering Commands

• Plugin installation command:

openclaw plugins install <path-or-spec>

• Hook installation command:

openclaw hooks install <path-or-spec>

When <path-or-spec> is a local directory or local archive, it will be resolved to the path used by the npm install --omit=dev --silent --ignore-scripts command mentioned above.

PoC

Currently, testpoc/ is a minimal PoC directory used to verify that “when installing local packages, OpenClaw enters the npm install --ignore-scripts path.” It is divided into two core sections:

testpoc/pkg/ Purpose: Simulates the local package directory installed by openclaw plugins install ... or openclaw hooks install ... testpoc/repo/ Purpose: Simulates a Git dependency repository within the npm dependency tree Directory Structure

testpoc/ ├─ pkg/ │ ├─ .npmrc │ ├─ package.json │ └─ sample-hook/ │ ├─ HOOK.md │ └─ handler.js └─ repo/ ├─…