Security researchers found hundreds of malicious add-ons on ClawHub.