OpenClaw marketplace's top-downloaded skill was malware; 1,184 malicious plugins stole SSH keys, crypto wallets, browser data via reverse shell backdoor—one attacker uploaded 677 packages exploiting weak verification

chiefofautism on X: "the #1 most downloaded skill on OpenClaw marketplace was MALWARE it stole your SSH keys, crypto wallets, browser cookies, and opened a reverse shell to the attackers server 1,184 malicious skills found, one attacker uploaded 677 packages ALONE OpenClaw has a skill marketplace https://t.co/3Qw9QoB1nt" / X

PostConversationthe #1 most downloaded skill on OpenClaw marketplace was MALWARE it stole your SSH keys, crypto wallets, browser cookies, and opened a reverse shell to the attackers server 1,184 malicious skills found, one attacker uploaded 677 packages ALONE OpenClaw has a skill marketplace called ClawHub where anyone can upload plugins you install a skill, your AI agent gets new powers, this sounds great the problem? ClawHub let ANYONE publish with just a 1 week old github account attackers up...