Clinejection: prompt injection and the unauthorized Cline CLI release
Cline’s issue-triage agent exposed a path to publishing credentials. A later unauthorized CLI release installed OpenClaw; Cline found no user data theft.
On this page(4)
On February 17, 2026, an unauthorized party used a compromised npm publishing token to release cline@2.3.0. The package added a postinstall command that globally installed OpenClaw. Cline published a corrected CLI version 2.4.0 about eight hours later and deprecated 2.3.0. The incident affected the CLI package distributed through npm, not Cline’s VS Code or JetBrains extensions.
What Cline confirmed
Cline compared the unauthorized package with its previous release. The CLI binary and other files were identical; the added postinstall command in package.json was the substantive change. Cline describes OpenClaw as a legitimate project whose installation was unauthorized. Its investigation found no user data access or exfiltration and no malicious code delivered to users. A download count is not a count of compromised machines, and the public report does not establish that thousands of systems were taken over.
The prompt-injection path
The earlier weakness was in Cline’s GitHub issue-triage workflow. It passed an untrusted issue title to an AI agent with Bash access. Security researcher Adnan Khan showed in a mirror repository that a crafted title could get the agent to run an attacker-controlled install command. He also demonstrated how code running in the triage job could poison a GitHub Actions cache later consumed by a more privileged nightly release workflow.
Khan reported the chain on January 1 and published his research on February 9. Cline removed the vulnerable workflow shortly after publication and began rotating publishing credentials. Its post-mortem says the team deleted the wrong npm token, leaving the exposed one active. A different actor then used that token on February 17 to publish the unauthorized CLI package. Khan says he did not test against Cline’s live repository; his proof of concept ran on a mirror. The research demonstration and the later unauthorized publish should not be collapsed into one action by the researcher.
What users and maintainers should check
If you installed Cline CLI from npm during the February 17 window, check cline --version. Cline advises users on 2.3.0 to update to a fixed version and remove a global OpenClaw installation if they did not intend it. Users of the VS Code and JetBrains extensions were not affected by this distribution incident, according to Cline.
For teams running AI in CI, the failure path is broader than this package: untrusted text entered an agent with shell access, a lower-trust workflow shared a cache boundary with publishing, and a token remained usable after a mistaken revocation. Cline removed the triage workflows and release cache use, revoked the tokens, and moved npm publishing to OIDC provenance. Scope agent tools, separate release workflows from lower-trust caches, and verify revocation against the actual credential rather than only a management page.
Sources
Read next
Long-exposed credentials: what a 90-day source record tells you
An old source record and an active key do not establish key age. Check when the value appeared, issuer status, permissions, and dependencies.
GhostAction Analysis: How a Malicious Workflow Collects Keys from Git History
A review of 100 public workflow samples and Uber repository events shows four collector versions. We examine deleted-key collection through Git patches, successful exits after transfer failure, and credential-based response priorities.
When the Security Scanner Became the Weapon: A Cyber Kill Chain Analysis of the Trivy Supply Chain Attack
Aqua Security's Trivy was compromised by TeamPCP, cascading into LiteLLM. A 7-phase Cyber Kill Chain and MITRE ATT&CK analysis of how incomplete credential rotation turned a single breach into a five-ecosystem catastrophe.
Get the next one in your inbox
Monthly NHI security brief from Cremit. One email, high signal.