
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
clawdhubClawdHub CLI — install, update, search, and publish agent skills as folders.
# From this repo (shortcut script at repo root)
bun clawdhub --help
# Once published to npm
# npm i -g clawdhub
clawdhub login
# or
clawdhub auth login
# Headless / token paste
# or (token paste / headless)
clawdhub login --token clh_...
Notes:
https://clawdhub.com/cli/auth and completes via a loopback callback.~/Library/Application Support/clawdhub/config.json on macOS (override via CLAWDHUB_CONFIG_PATH).clawdhub search "postgres backups"
clawdhub install my-skill-pack
clawdhub update --all
clawdhub update --all --no-input --force
clawdhub publish ./my-skill-pack --slug my-skill-pack --name "My Skill Pack" --version 1.2.0 --changelog "Fixes + docs"
# Start anywhere; scans workdir first, then legacy Clawdis/Clawd locations.
clawdhub sync
# Explicit roots + non-interactive dry-run
clawdhub sync --root ../clawdis/skills --all --dry-run
https://clawdhub.com (override via --site or CLAWDHUB_SITE)/.well-known/clawdhub.json on the site (override via --registry or CLAWDHUB_REGISTRY)--workdir or CLAWDHUB_WORKDIR)./skills under workdir (override via --dir)FAQs
ClawdHub CLI \u2014 install, update, search, and publish agent skills.
The npm package clawdhub receives a total of 5,739 weekly downloads. As such, clawdhub popularity was classified as popular.
We found that clawdhub demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.