Compromised npm token pushes Cline CLI release that silently installs OpenClaw

On 17 February 2026 an unauthorized party used a compromised npm publish token to release version 2.3.0 of the Cline CLI, the command-line package of the open source AI coding assistant. The release added an install script that globally installed OpenClaw, a separate AI agent framework, on every machine that installed it during an eight-hour window.

What happened

The package differed from the legitimate 2.2.3 release only in its package.json, which gained a postinstall hook; the CLI binary and other contents were unchanged. Dark Reading reported that the token theft traced back to a prompt injection weakness in an automated issue triage workflow in the Cline repository, present between 21 December 2025 and 9 February 2026, which could expose secrets such as release tokens.

Impact

StepSecurity, cited by Dark Reading, counted approximately 4,000 downloads of the tainted package before it was deprecated. Cline said OpenClaw itself is legitimate and not malicious, but its installation was never authorized. Researchers quoted by Dark Reading warned that OpenClaw runs with broad permissions and full disk access and keeps a background gateway daemon, which would make an unwanted copy a valuable foothold. The Cline VS Code extension and JetBrains plugin were not affected.

Response

Cline published a corrected 2.4.0 release at 11:23 AM PT and deprecated 2.3.0 seven minutes later. It revoked the compromised token and moved npm publishing to OIDC provenance through GitHub Actions, and it advised affected users to update and remove any unintended OpenClaw installation.

Lessons for security leaders

• An AI bot that reads public issues and holds repository secrets is a prompt injection target. Keep such workflows away from publishing credentials.
• A benign payload is still an unauthorized install. Treat surprise agents on endpoints as incidents, because their permissions are the risk.
• Watch for packages published without the provenance attestation a project normally carries.
• Block or review global package installs triggered by postinstall scripts on developer machines and build runners.