Supply ChainJun 24, 2026
More Malicious OpenClaw Skills Threaten AI Supply Chain
OpenClaw removed five malicious packages from its AI skills marketplace, ClawHub.
Vendor Watch
Run OpenClaw?
Get an email when a reviewed story names OpenClaw, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works
Summary
OpenClaw has removed five malicious packages from its AI skills marketplace, ClawHub. These packages, designed to mimic legitimate AI tools, contained infostealers and other malware, and had bypassed the platform's security checks. This incident highlights ongoing risks within the AI supply chain, where malicious code can be disguised as useful tools.
Entities
OpenClaw (product)ClawHub (product)AI (technology)