ClawHub, an AI plugin registry used by AI agents like Claude and OpenClaw, uses npm-style scopes to denote package ownership. However, 23 plugins were published under official scopes (@openclaw and @clawhub) by unrelated accounts due to insufficient scope reservation controls. This namespace squatting poses a supply chain risk by misleading users about the provenance of plugins, even if the code is not inherently malicious. After disclosure, ClawHub implemented changes to mitigate this risk. The incident highlights emerging security challenges in AI registries as the ecosystem grows.

The main impact is a supply chain risk where malicious or untrusted code could be distributed under official-looking scopes, potentially deceiving users or automated systems that rely on scope as a trust indicator. Although no active exploitation or malicious code was reported, the namespace squatting undermines trust in the plugin ecosystem and could facilitate future attacks if exploited.

The ClawHub registry has made changes following the disclosure to better reserve official scopes and prevent unauthorized publishing under them. Users should verify plugin provenance beyond scope names and monitor vendor advisories for further updates. Patch status is not explicitly stated; check the ClawHub vendor advisory or official communications for current remediation guidance.