Comment by Akronymus

Seems like essentially the same threat vector as with NPM.

Not quite related: I never heard of clawdbot before, so, I guess TIL that's the bot my website keeps getting requests that are obviously malicious from.