Executive brief
An attacker gained control of the npm publishing token for Cline CLI, a command-line tool, and released version 2.3.0 with a modified installation script that automatically downloads and installs an unintended open-source package globally. While the installed package (openclaw) is itself benign, the unauthorized modification represents a supply-chain compromise that could be leveraged to inject malicious payloads in future releases. Users affected during the 8-hour window were forced to install unwanted software.
Technical details
This is a supply-chain attack exploiting a compromised npm publishing token (CWE-506: Embedded Malicious Code). The attacker modified the package.json postinstall script in cline@2.3.0 to execute "npm install -g openclaw@latest" during installation, causing unauthorized global package installation. The attack affects only the npm CLI package distributed via the npm registry; the VS Code extension and JetBrains plugin were unaffected. The malicious version was published for approximately 8 hours (Feb 17, 3:26 AM–11:30 AM PT) before being deprecated and replaced with version 2.4.0. The compromised token has been revoked and the project now uses OIDC provenance via GitHub Actions for future publishes.
Affected products
- Cline CLI 2.3.0
Timeline
- 2026-02-17: disclosed: Unauthorized cline@2.3.0 published at 3:26 AM PT
- 2026-02-17: patched: Version 2.4.0 published at 11:23 AM PT
- 2026-02-19: other: GHSA-9ppg-jx86-fqw7 published in GitHub Advisory Database