GoPlus：ClawHub 存在下載量偽造漏洞，熱門技能或含惡意代碼
Mar 26, 2026 19:26:53
Chia sẻ để 
ChainCatcher 消息，据 GoPlus Security 發布的安全警告，Silverfort 安全研究人員在 OpenClaw 的技能倉庫 ClawHub 中發現嚴重漏洞。攻擊者可通過調用內部函數 downloads:increment 繞過所有防護機制，僅憑一條 curl 請求即可將下載量在數分鐘內刷至 2 萬次以上，從而將含惡意代碼的技能推至搜索排名第一，誘導用戶或 AI Agent 自動安裝。
惡意技能一旦運行，可竊取加密錢包、API 密鑰等敏感數據。目前該漏洞已在 24 小時內完成修復。GoPlus 提示用戶，高下載量不等於安全，建議使用 AgentGuard 進行安全掃描與防護。
Tin tức mới nhất
Naoris Protocol's quantum-resistant blockchain goes live as Bitcoin and Ethereum face 'Q-Day' threats
Coindesk
Apr 3, 2026 23:44:38
Algorand Soars Double-Digits On Google ‘Post-Quantum Protocols’ Citation
Decrypt
Apr 3, 2026 11:35:36
AdEx Rebrands as heyAura, Shifting Focus to AI Agents for Web3 Wallets
Chainwire
Apr 2, 2026 21:06:26
Aztec Launches Alpha Network, Ethereum's First L2 for Private Smart Contracts
The Defiant
Apr 1, 2026 02:00:01
OneBullEx Launches AI-Native Futures Platform with Quant Research and Systematic Execution for Crypto Derivatives
Chainwire
Mar 31, 2026 13:46:42
