NewsPublished 22 Jun 2026

23 ClawHub plugins squatting official scopes expose AI registry security gaps

Source Reddit Cybersecurity

Discussion

A security issue was identified in the ClawHub AI plugin registry where 23 plugins were found squatting official npm-style scopes such as @openclaw/ and @clawhub/. These scopes, which are intended to indicate official ownership, were not properly reserved, allowing unrelated accounts to publish plugins under these trusted namespaces. This creates a supply chain risk because users may trust plugins based on their official-looking scope even if the code is not malicious. The registry has made changes following disclosure to address this issue. This reflects broader security gaps emerging alongside new AI tools and registries.

r/cybersecurity (opens in a new tab)u/sunychoudhary0 points0 comments

https://www.helpnetsecurity.com/2026/06/22/clawhub-code-executing-plugins-video/

Links cited in the discussion

https://www.helpnetsecurity.com/2026/06/22/clawhub-code-executing-plugins-video/

Impact

The main impact is a supply chain risk where malicious or untrusted code could be distributed under official-looking scopes, potentially deceiving users or automated systems that rely on scope as a trust indicator. Although no active exploitation or malicious code was reported, the namespace squatting undermines trust in the plugin ecosystem and could facilitate future attacks if exploited.

Defensive guidance

The ClawHub registry has made changes following the disclosure to better reserve official scopes and prevent unauthorized publishing under them. Users should verify plugin provenance beyond scope names and monitor vendor advisories for further updates. Patch status is not explicitly stated; check the ClawHub vendor advisory or official communications for current remediation guidance.

Summary

ClawHub, an AI plugin registry used by AI agents like Claude and OpenClaw, uses npm-style scopes to denote package ownership. However, 23 plugins were published under official scopes (@openclaw and @clawhub) by unrelated accounts due to insufficient scope reservation controls. This namespace squatting poses a supply chain risk by misleading users about the provenance of plugins, even if the code is not inherently malicious. After disclosure, ClawHub implemented changes to mitigate this risk. The incident highlights emerging security challenges in AI registries as the ecosystem grows.

References

Community reviews

Loading reviews…

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 22 Jun 2026, 10:24 UTC

Technical details

References

Community reviews