Reported observations below are attributed to the linked sources. Review questions and controls are editorial interpretation.
What the source reports
Antiy describes malicious ClawHub packages disguised as useful extensions, with ClickFix-style setup lures. Its report credits Koi with naming ClawHavoc. OpenSourceMalware independently documents early uploads using a supposed authentication prerequisite. These accounts can cover overlapping artifacts.
The trust boundary
A package author’s setup instructions were treated as a reason to trust an external installation step.
What this does not establish
Reports document packages and delivery behavior. They do not establish how many unique people installed them or suffered verified losses. Different dates and collection methods explain why published totals differ.
We reviewed the linked publication text or cataloged evidence level. We did not execute the suspect package, independently reproduce the investigation, or verify current registry availability.
Questions for a review
These are practical questions prompted by the case, not controls independently validated by this website.
- Prerequisite origin
- Who owns the alleged dependency, and which evidence independent of the skill establishes its identity?
- Agent-to-human handoff
- Does the workflow ask a person to perform an action the constrained agent cannot perform?
- Counting overlap
- Do reports describe the same package revisions, publisher identifiers, or campaign window?
Editorial lesson
Review prerequisites as separate dependencies. The approval to use a skill is not approval to run every installer it recommends.
For your own environment, turn the question into a bounded test with an exact package identity, synthetic input, expected permitted behavior, prohibited effect, and observable stopping point. Keep a blocked attempt distinct from a completed effect. Preserve the legitimate task result alongside the security observation.