Compromised npm package silently installs OpenClaw on developer machines

A new security bypass has users installing AI agent OpenClaw — whether they intended to or not. Researchers have discovered that a compromised npm publish token pushed an update for the widely-used Cline command line interface (CLI) containing a malicious postinstall script. That script installs the wildly popular, but increasingly condemned, agentic application OpenClaw on…

Read More

EFF thinks it’s cracked the AI slop problem

The Electronic Frontier Foundation (EFF) Thursday changed its policies regarding AI-generated code to “explicitly require that contributors understand the code they submit to us and that comments and documentation be authored by a human.” The EFF policy statement was vague about how it would determine compliance, but analysts and others watching the space speculate that…

Read More