
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
ClawHub CLI \u2014 install, update, search, and publish skills plus OpenClaw packages.
clawhubClawHub CLI — install, update, search, and publish agent skills plus OpenClaw packages.
# From this repo (shortcut script at repo root)
bun clawhub --help
# Once published to npm
# npm i -g clawhub
clawhub login
# or
clawhub auth login
# Headless / token paste
# or (token paste / headless)
clawhub login --token clh_...
Notes:
https://clawhub.ai/cli/auth and completes via a loopback callback.~/Library/Application Support/clawhub/config.json on macOS (override via CLAWHUB_CONFIG_PATH, legacy CLAWDHUB_CONFIG_PATH).clawhub search "postgres backups"
clawhub install my-skill-pack
clawhub update --all
clawhub update --all --no-input --force
clawhub publish ./my-skill-pack --slug my-skill-pack --name "My Skill Pack" --version 1.2.0 --changelog "Fixes + docs"
clawhub package explore --family skill
clawhub package explore --family code-plugin
clawhub package inspect @openclaw/example-plugin
clawhub package publish ./example-plugin --source-repo openclaw/example-plugin --source-commit abc123
# Start anywhere; scans workdir first, then legacy Clawdis/Clawd/OpenClaw/Moltbot locations.
clawhub sync
# Explicit roots + non-interactive dry-run
clawhub sync --root ../clawdis/skills --all --dry-run
https://clawhub.ai (override via --site or CLAWHUB_SITE, legacy CLAWDHUB_SITE)/.well-known/clawhub.json on the site (legacy /.well-known/clawdhub.json; override via --registry or CLAWHUB_REGISTRY)--workdir or CLAWHUB_WORKDIR)./skills under workdir (override via --dir)FAQs
ClawHub CLI \u2014 install, update, search, and publish skills plus OpenClaw packages.
The npm package clawhub receives a total of 182,504 weekly downloads. As such, clawhub popularity was classified as popular.
We found that clawhub demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.