Loading story…
Cline CLI’s npm package was briefly compromised after an attacker used a stolen/compromised npm publish token to publish cline@2.3.0. The unauthorized release modified package.json to add a postinstall script that globally installed openclaw@latest, causing users who installed/updated during the exposure window (reported as ~8 hours) to unknowingly pull in OpenClaw alongside Cline. While OpenClaw was described as a legitimate open-source AI assistant rather than overt malware, it is a high-privilege local agent (including a gateway daemon and integrations such as WhatsApp/Telegram/Slack/Discord/iMessage), and the incident was treated as a supply-chain compromise requiring remediation.
Independent analysis tied the incident to a broader disclosure about prompt-injection-driven supply-chain risk affecting Cline’s ecosystem, including the possibility of stealing repository/auth tokens via prompt injection and subsequent CI/CD or release pipeline abuse (e.g., GitHub Actions leading to token compromise). Detection tooling flagged the anomalous appearance of an install script in a package version that previously had none, and the compromised version was later deprecated/replaced; impacted users were advised to remove the unexpected global install:
npm uninstall -g openclaw
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
On 2026-02-19, follow-on forensic analysis reported high-confidence attribution to a GitHub user named “glthub-actions.” The report said the actor likely exploited the disclosed issue-triage prompt-injection weakness to exfiltrate publishing secrets and publish the unauthorized npm package.
Cline published GitHub Security Advisory GHSA-9ppg-jx86-fqw7 documenting the unauthorized cline@2.3.0 npm publish and providing upgrade and removal guidance for users who may have installed OpenClaw. The advisory described the incident as affecting installs during an approximately eight-hour window.
As part of the same-day response, Cline revoked the compromised npm token and migrated npm publishing to GitHub Actions OIDC provenance. The change was intended to reduce reliance on long-lived static publishing credentials.
Later on 2026-02-17, Cline remediated the incident by deprecating cline@2.3.0 and publishing cline@2.4.0. The maintainers also stated that the VS Code extension and JetBrains plugin were not affected.
The tainted cline@2.3.0 release was available for roughly eight hours on 2026-02-17 before being pulled, with reports estimating about 4,000 downloads during that window. Microsoft and others observed an uptick in OpenClaw installations tied to the unauthorized install script.
On 2026-02-17, an unauthorized party used a compromised npm publish token to release cline@2.3.0 to the npm registry. The package was modified only in package.json to add a postinstall script that globally installed openclaw@latest.
Following the public disclosure, Cline removed the vulnerable workflows and implemented mitigations within about 30 minutes, including credential rotation. Later reporting indicated the rotation was incomplete, leaving at least one publish token still valid.
After reporting no substantive response, Adnan Khan publicly disclosed the vulnerability chain in early February 2026, with multiple sources placing the disclosure on 2026-02-09. The disclosure described how prompt injection against Cline’s issue-triage automation could lead to GitHub Actions compromise and token theft.
Security researcher Adnan Khan said he privately contacted Cline starting on 2026-01-01 about a supply-chain vulnerability involving prompt injection in Cline’s AI-powered GitHub Actions workflows. The reported issue could enable code execution, cache poisoning, and theft of publishing credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourcego.theregister.com
Open sourcecsoonline.com
Open sourcembgsec.com
Open sourceendorlabs.com
Open sourcesocket.dev
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A suspected npm supply-chain compromise affected the widely used autonomous coding agent CLI *cline* when version **`cline@2.3.0`** was published with a **malicious `postinstall` script** that silently installed a secondary package, **`openclaw`**, on systems running `npm install cline`. StepSecurity reported the release was downloaded roughly **4,000 times** before maintainers deprecated it about **8 hours** after publication, and noted the release deviated from prior **OIDC-based GitHub Actions Trusted Publishing** by being **manually published** by an npm user account—an anomaly consistent with compromised credentials or a hijacked release process. In parallel, Adversa AI described *SecureClaw*, an open-source **security plugin + skill** intended to add auditing and rule-based controls to **OpenClaw** agent environments and to reduce exposure to issues like **prompt injection** by enforcing controls at the plugin (code) layer rather than relying only on in-context “skill” instructions. While not a direct incident report, the SecureClaw release is contextually relevant because it targets the same *OpenClaw* ecosystem that was leveraged as the silently installed dependency in the *cline* incident, underscoring growing security concerns around AI agent tooling, supply-chain risk, and enforceable guardrails for agent permissions and behavior.
Jun 29, 2026
The open-source AI coding assistant **Cline** has faced two serious security incidents affecting developers: a supply-chain compromise of its npm distribution and a critical local WebSocket vulnerability that can lead to remote code execution. In the npm incident, an unauthorized actor published `cline@2.3.0`, which silently installed the **OpenClaw** package on user systems through the Cline CLI installation path. Maintainers said the malicious release was available for roughly eight hours, revoked the compromised publishing token, shifted npm publishing to **OIDC provenance via GitHub Actions**, and urged users who installed the affected version to upgrade to `2.4.0` or later and inspect their environments. Reporting cited roughly 4,000 downloads before the package was deprecated, with Microsoft also observing increased OpenClaw installations linked to the Cline installer. Separately, GitHub disclosed **CVE-2026-44211**, a `9.7`-severity cross-origin WebSocket hijacking flaw in the `kanban` npm package used by Cline. The issue stems from a local server on `127.0.0.1:3484` accepting unauthenticated cross-origin WebSocket connections without validating the `Origin` header, exposing endpoints including `/api/runtime/ws`, `/api/terminal/io`, and `/api/terminal/control`. A developer who visits a malicious website while Cline is running can have workspace paths, task data, git details, and AI chat messages exfiltrated; attackers can also inject prompts into active agent terminals to achieve arbitrary code execution or terminate sessions for denial of service on macOS, Linux, and Windows. At the time of disclosure, recommended mitigations included adding Origin validation, randomized session tokens, and authentication for terminal WebSocket access.
Jun 29, 2026
OpenClaw disclosed several high-severity vulnerabilities that can lead to arbitrary code execution and security control bypass across recent releases. **CVE-2026-35641** affects versions before `2026.3.24` and lets a malicious local plugin or hook package use a crafted `.npmrc` file to override the `git` executable during `npm install`, resulting in arbitrary program execution. **CVE-2026-41349** affects versions before `2026.3.28` and allows low-privileged remote attackers to bypass execution approval through `config.patch`, silently disabling agentic consent protections. Belgium's Centre for Cybersecurity warned that multiple OpenClaw flaws can lead to RCE and urged immediate patching. Additional OpenClaw issues published shortly after expand the attack surface. **CVE-2026-41336** affects versions before `2026.3.31` and allows workspace `.env` files to override `OPENCLAW_BUNDLED_HOOKS_DIR`, causing trusted bundled hooks to be replaced with attacker-controlled code from untrusted workspaces. **CVE-2026-41352**, also fixed in `2026.3.31`, allows a device-paired node to bypass the node scope gate and execute arbitrary node commands on the host without proper pairing validation. Separately, the Node.js package **simple-git** disclosed **CVE-2026-6951**, an RCE flaw in versions before `3.36.0` caused by incomplete blocking of Git configuration options, allowing attackers to abuse `--config`, enable `protocol.ext.allow=always`, and trigger execution through an `ext::` clone source when untrusted input reaches the library's options.
Jun 29, 2026