Case cline-cli-openclawAI supply chainWorldwide
Compromised Cline CLI npm release silently installs OpenClaw agent
A stolen npm token was used to publish cline@2.3.0 with a postinstall script that globally installed the OpenClaw agent; it was live about 8 hours and downloaded ~4,000 times.
MediumAttack on AIStatus: ResolvedVerified case file
Open in the interactive mapCite this case
- Reported
- Feb 17, 2026
- Location
- Worldwide
- Target
- Cline CLI users
- Severity
- Medium
- Triggered by
- Unknown party using a stolen npm publish token
- Actor type
- Unknown
- Reported loss
- None reported
- CVE
- None
What happened
A stolen npm token was used to publish cline@2.3.0 with a postinstall script that globally installed the OpenClaw agent; it was live about 8 hours and downloaded ~4,000 times.
Impact: About 4,000 downloads in an eight-hour window installed OpenClaw globally without consent; no credential theft or malicious payload reported.
Who triggered it
Actor: Unknown party using a stolen npm publish token
Attribution: No public attribution; Cline says a compromised npm token was used. One vendor report ties it to prior AI triage workflow research by Adnan Khan
Motive: Unclear; payload was a legitimate package, possibly a prank or demonstration
How it happened
Attack vector: Unauthorized npm publish of cline@2.3.0 with a postinstall script running npm install -g openclaw@latest
Root cause: Long-lived npm publish token exposed via a GitHub Actions workflow; no trusted publishing or provenance enforcement
Timeline
- cline@2.3.0 published at 3:26 AM PT with malicious postinstall
- Clean 2.4.0 published at 11:23 AM PT and 2.3.0 deprecated at 11:30 AM PT
- GHSA-9ppg-jx86-fqw7 advisory and media coverage
Response
Cline revoked the token, moved publishing to OIDC provenance via GitHub Actions, published 2.4.0 and told users to uninstall OpenClaw if unwanted.
Current status: Resolved
Sources (open in a new tab)
- Dark Reading darkreading.com
- The Hacker News thehackernews.com
- Endor Labs endorlabs.com
- GitHub Advisory via OSV osv.dev
Cite this case
Compromised Cline CLI npm release silently installs OpenClaw agent. AI Threat Watch, case cline-cli-openclaw, Feb 17, 2026. https://aithreat.io/cases/cline-cli-openclaw/
Permanent link: https://aithreat.io/cases/cline-cli-openclaw/