Loading story…
A suspected npm supply-chain compromise affected the widely used autonomous coding agent CLI cline when version cline@2.3.0 was published with a malicious postinstall script that silently installed a secondary package, openclaw, on systems running npm install cline. StepSecurity reported the release was downloaded roughly 4,000 times before maintainers deprecated it about 8 hours after publication, and noted the release deviated from prior OIDC-based GitHub Actions Trusted Publishing by being manually published by an npm user account—an anomaly consistent with compromised credentials or a hijacked release process.
In parallel, Adversa AI described SecureClaw, an open-source security plugin + skill intended to add auditing and rule-based controls to OpenClaw agent environments and to reduce exposure to issues like prompt injection by enforcing controls at the plugin (code) layer rather than relying only on in-context “skill” instructions. While not a direct incident report, the SecureClaw release is contextually relevant because it targets the same OpenClaw ecosystem that was leveraged as the silently installed dependency in the cline incident, underscoring growing security concerns around AI agent tooling, supply-chain risk, and enforceable guardrails for agent permissions and behavior.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
By 2026-02-18, Adversa AI had released SecureClaw as a free open-source project on GitHub to secure OpenClaw-based AI agent environments. The project combines a code-level plugin and an agent skill, with audit checks, hardening modules, behavioral rules, and mappings to OWASP ASI Top 10, MITRE ATLAS, and CoSAI guidance.
The cline supply-chain incident was tracked under GitHub Security Advisory GHSA-9ppg-jx86-fqw7, documenting the malicious package version and remediation guidance. This formalized the issue as a disclosed security advisory.
About eight hours after the malicious release, after roughly 4,000 downloads, maintainers deprecated cline 2.3.0 and later published a clean version through the trusted pipeline. Users were directed to upgrade to version 2.4.0 or later and remove any unintended global installation of openclaw.
On 2026-02-17, StepSecurity detected the malicious cline release and identified indicators including publication by the npm user clinebotorg, deviation from the project's prior GitHub Actions OIDC trusted publishing pattern, and missing npm provenance attestations. The incident was also independently discovered and reported by Adnan Khan.
On 2026-02-17, a suspicious npm release of the cline autonomous coding agent CLI was published as version 2.3.0. The package included a malicious post-install script that silently installed the openclaw package globally, creating a supply-chain risk for developer and CI/CD environments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcestepsecurity.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Cline CLI**’s npm package was briefly compromised after an attacker used a **stolen/compromised npm publish token** to publish `cline@2.3.0`. The unauthorized release modified `package.json` to add a `postinstall` script that **globally installed** `openclaw@latest`, causing users who installed/updated during the exposure window (reported as ~8 hours) to unknowingly pull in *OpenClaw* alongside Cline. While *OpenClaw* was described as a legitimate open-source AI assistant rather than overt malware, it is a high-privilege local agent (including a gateway daemon and integrations such as WhatsApp/Telegram/Slack/Discord/iMessage), and the incident was treated as a **supply-chain compromise** requiring remediation. Independent analysis tied the incident to a broader disclosure about **prompt-injection-driven supply-chain risk** affecting Cline’s ecosystem, including the possibility of **stealing repository/auth tokens** via prompt injection and subsequent CI/CD or release pipeline abuse (e.g., GitHub Actions leading to token compromise). Detection tooling flagged the anomalous appearance of an install script in a package version that previously had none, and the compromised version was later deprecated/replaced; impacted users were advised to remove the unexpected global install: ```bash npm uninstall -g openclaw ```
Jun 29, 2026
The open-source AI coding assistant **Cline** has faced two serious security incidents affecting developers: a supply-chain compromise of its npm distribution and a critical local WebSocket vulnerability that can lead to remote code execution. In the npm incident, an unauthorized actor published `cline@2.3.0`, which silently installed the **OpenClaw** package on user systems through the Cline CLI installation path. Maintainers said the malicious release was available for roughly eight hours, revoked the compromised publishing token, shifted npm publishing to **OIDC provenance via GitHub Actions**, and urged users who installed the affected version to upgrade to `2.4.0` or later and inspect their environments. Reporting cited roughly 4,000 downloads before the package was deprecated, with Microsoft also observing increased OpenClaw installations linked to the Cline installer. Separately, GitHub disclosed **CVE-2026-44211**, a `9.7`-severity cross-origin WebSocket hijacking flaw in the `kanban` npm package used by Cline. The issue stems from a local server on `127.0.0.1:3484` accepting unauthenticated cross-origin WebSocket connections without validating the `Origin` header, exposing endpoints including `/api/runtime/ws`, `/api/terminal/io`, and `/api/terminal/control`. A developer who visits a malicious website while Cline is running can have workspace paths, task data, git details, and AI chat messages exfiltrated; attackers can also inject prompts into active agent terminals to achieve arbitrary code execution or terminate sessions for denial of service on macOS, Linux, and Windows. At the time of disclosure, recommended mitigations included adding Origin validation, randomized session tokens, and authentication for terminal WebSocket access.
Jun 29, 2026
A high-severity vulnerability in the open-source AI utility **OpenClaw** (formerly *Moltbot/ClawdBot*) allows attackers to steal an instance’s gateway token via a crafted link and gain “god mode” administrative control, potentially leading to **remote code execution (RCE)**. The issue stems from the UI failing to validate/sanitize query strings in the gateway URL; when a victim opens a malicious URL or phishing page, the browser initiates a WebSocket connection that leaks the stored gateway token in the payload, enabling an attacker to connect back to the target’s local gateway and change configuration or execute privileged actions. The flaw was reported via responsible disclosure and is fixed in **v2026.1.29** and later; deployments on **v2026.1.28 or earlier** are advised to upgrade. Separate reporting describes a broader criminal ecosystem of **autonomous AI agents** using OpenClaw as a local runtime alongside a collaboration network (*Moltbook*) and an underground marketplace (*Molt Road*) to trade stolen credentials, weaponized code, and alleged zero-days, with claims of rapid scaling to hundreds of thousands of agents and use of infostealer logs/session cookies to bypass MFA and automate intrusion lifecycles (lateral movement, ransomware, and crypto-funded operations). Another item is a vendor blog post focused on **prompt-injection detection** and speculative **quantum** risks to encrypted AI orchestration streams (MCP), which is not tied to the OpenClaw vulnerability disclosure or the specific criminal-agent ecosystem claims.
Jun 29, 2026