OpenClaw Plugin Center Targeted by Supply Chain Attacks

OpenClaw's official plugin center, ClawHub, is currently facing supply chain attacks, according to Foresight News. The platform's lack of stringent review mechanisms has allowed numerous malicious Skills to infiltrate, spreading harmful code. To date, 341 malicious Skills have been identified, often disguised as tools for cryptocurrency, security checks, or automation. Attackers are exploiting the SKILL.md file as an entry point for executing commands, using Base64 encoding to conceal malicious instructions. The attack employs a two-stage loading mechanism to evade detection. In the first stage, the payload is retrieved via curl, and in the second stage, a sample named dyrtvwjfveyxjf23 is deployed to trick users into entering system passwords and stealing local documents and system information. Users are advised by SlowMist to review any commands that need to be copied and executed, be cautious of prompts requesting system permissions, and prioritize obtaining tools through official channels.