Poisoning the well: AI supply chain attacks on Hugging Face and OpenClaw

Threat actors are actively abusing trusted AI platforms like Hugging Face and ClawHub to deliver malware disguised as legitimate models and agent extensions, leveraging supply chain attacks and indirect prompt injection to compromise users and automate further malicious actions across AI-driven workflows.