SlowMist has published new findings showing that ClawHub , the plugin hub used by the open-source artificial intelligence (AI) agent project OpenClaw, has become a frequent target for supply-chain attacks .