Cline CLI installed openclaw

On the morning of February 17, 2026, an unknown party used an exposed npm publish token to push [email protected], a release that was byte-identical to the previous version except for a postinstall script that quietly installed a second package called OpenClaw on every machine that ran the upgrade. The package sat on the registry for roughly eight hours before Cline pulled it.

Cline is an AI coding assistant distributed as an npm CLI; its January 2026 download volume was around 418,000, according to Endor Labs. The malicious 2.3.0 release was downloaded about 4,000 times before deprecation, The Register reported.

The access path mattered more than the payload. Researcher Adnan Khan had earlier disclosed a prompt-injection weakness in Cline's AI-driven issue triage workflow, showing how a carefully written GitHub issue could manipulate the automation that held release credentials. Cline removed the workflow, but the rotation that followed failed: the wrong token was deleted, and npm's org-level token page showed zero active tokens while the exposed one stayed live. A different actor later used that token to publish 2.3.0. Endor Labs, which reverse-engineered the tarball (SHA-256 c5b2c21abdf0606a881f293e1cce61d38b90dac0ae647a943d36464530fbf804), noted that OpenClaw is itself a legitimate open-source project and that the compromised release did not start its gateway daemon. The harm was the silent, unrequested global install of software from a trusted package channel.

In a post-mortem, Cline said it deprecated 2.3.0, shipped 2.4.0, revoked the compromised token, and moved npm publication to OIDC provenance through GitHub Actions. The broader takeaway, StepSecurity and others noted, is that AI-driven project automation has effectively become release infrastructure. When prompt injection can reach that automation, ordinary registry credentials are what get left behind.