@cwebber

The postinstall script installs a legitimate, non-malicious package (OpenClaw). There is no malware to detect.

i beg to differ