A compromised publish token gave attackers brief but concerning access to the Cline CLI npm package, exposing developers who installed it during an 8-hour window on February 17, 2026. The incident highlights the growing risk of supply chain attacks targeting developer tooling ecosystems.
On February 17 at 3:26 AM PT, an unauthorized party leveraged a stolen npm publish token to push a malicious version of the Cline CLI — a popular AI coding assistant used within VS Code and JetBrains environments to the npm registry as cline@2.3.0.
The attacker modified only one file: the package.json, injecting a postinstall script that silently executed npm install -g openclaw@latest upon installation. All other package contents, including the core CLI binary (dist/cli.mjs), remained identical to the legitimate cline@2.2.3 release.
While OpenCLAW is described as a legitimate, non-malicious open source package, its unauthorized installation raises serious concerns about the potential for more dangerous payloads in similar future attacks.
The Cline team detected the tampered release and published a corrected version (2.4.0) at 11:23 AM PT, with the compromised 2.3.0 deprecated at 11:30 AM PT, roughly 8 hours after the initial unauthorized publish.
The compromised token has since been revoked, and the project has migrated npm publishing to OIDC provenance via GitHub Actions to harden the release pipeline going forward.
The Cline VS Code extension and JetBrains plugin were not affected by this incident.
Developers who installed cline@2.3.0 during the affected window should immediately update to the latest version using cline update or npm install -g cline@latest and confirm the version with cline --version.
If OpenCLAW was unintentionally installed, it can be removed via npm uninstall -g openclaw.
Organizations using AI developer tools in their pipelines should audit installed CLI tooling and enforce token hygiene across all package registries.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
Your SaaS estate M365, Salesforce, Workday, Slack, hundreds of others is a sprawl of misconfigurations,…
DSPM finds sensitive data you didn’t know you had, classifies it, maps who can reach…
Open-source packages are meant to save developers time. In the GemStuffer campaign, that trust became…
Google has released an important Chrome 153 security update that fixes 42 vulnerabilities across the…
The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology…
CISA and five international cybersecurity agencies have released detailed guidance describing 17 common techniques hackers…