GoPlus 警告:ClawHub 存在下载量伪造漏洞,恶意技能可窃取钱包数据

Gate News 消息,3 月 26 日,GoPlus Security 发布安全警告称,Silverfort 安全研究人员在 OpenClaw 的技能仓库 ClawHub 中发现严重漏洞。攻击者可通过调用内部函数 downloads:increment 绕过防护机制,仅用一条 curl 请求即可在数分钟内将下载量刷至 2 万次以上,从而将含恶意代码的技能推至搜索排名第一,诱导用户或 AI Agent 自动安装。恶意技能一旦运行,可窃取加密钱包、API 密钥等敏感数据。该漏洞已在 24 小时内完成修复。GoPlus 提示,高下载量不等于安全,建议使用 AgentGuard 进行安全扫描与防护。

Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to Disclaimer.
Opmerking
0/400
Geen opmerkingen