OpenClaw is dealing with two security incidents at the same time. SlowMist founder Yu Xian warned that the latest version 3.28 may pull in a poisoned axios package through the software supply chain. On the same day, 360 Digital Security Group disclosed a high-risk MEDIA protocol vulnerability in OpenClaw, saying that more than 170,000 publicly accessible instances worldwide are exposed.
Version 3.28 may include a malicious axios release
According to Yu Xian, users running OpenClaw 3.28 should check whether their deployment imported a compromised axios package, and related Skills could also be affected through indirect dependencies. A report from security research firm Socket said the axios npm account was compromised on March 30. Within 39 minutes, the attacker published two malicious versions, 1.14.1 and 0.30.4, contaminating both the 1.x and 0.x release lines and adding a malicious dependency called plain-crypto-js.
The malicious package was described as a multi-stage remote access trojan, or RAT. It can execute arbitrary commands, steal system data, and establish persistence on infected devices. Socket said the payload was tailored for different operating systems: on macOS it disguised itself as an Apple system daemon and wrote into cache directories; on Windows it renamed PowerShell and executed through VBScript; on Linux it downloaded a Python script into a temporary directory and ran it there.
Socket’s automated scanning system reportedly flagged the malicious package 6 minutes after it went live. Even so, axios sees roughly 100 million weekly downloads, which means projects using caret version ranges may have automatically installed the compromised release. The affected downstream packages named in the source include @shadanai/openclaw and @qqbrowser/openclaw-qbot.
360 says MEDIA protocol flaw has been confirmed by CNNVD
Separate from the supply chain issue, 360 Digital Security Group said its multi-agent vulnerability discovery system found a high-risk flaw in OpenClaw: a MEDIA protocol prompt injection issue that can bypass tool permissions and expose local files. The vulnerability has been confirmed by the China National Vulnerability Database (CNNVD), with the impact spanning more than 50 countries and regions.
According to 360, the core risk comes from the MEDIA protocol running in the post-output processing layer, allowing it to bypass the platform’s tool policy controls. Even if an agent has all tool calls disabled, an attacker with only basic group chat member privileges may still launch an attack, obtain sensitive server information, and trigger follow-on network intrusions. The disclosure states that over 170,000 publicly reachable OpenClaw instances are at risk.
The source also noted that since the start of 2026, CNNVD has recorded 82 OpenClaw-related vulnerabilities, including 12 critical and 21 high-risk cases.
Checks should focus on versions and dependency trees
For current OpenClaw users, the immediate priority is to inspect versions and dependencies. If the deployment is running 3.28, the source recommends checking the axios version under node_modules. If 1.14.1 or 0.30.4 is present, it should be removed and downgraded to a safe version. One quick indicator is the dependency list: legitimate axios releases include only follow-redirects, form-data, and proxy-from-env; the presence of plain-crypto-js indicates compromise.
Because axios is widely used, the review should not stop at OpenClaw itself. Environments that installed Skills or third-party extensions also need inspection. The source further advised restricting network access to OpenClaw instances so they are not directly exposed to the public internet.