On February 17, 2026, the popular AI coding assistant Cline CLI (formerly Claude Dev) was the target of a supply chain attack where an unauthorized version, [email protected], was published to the npm registry. 

The compromised version was live for approximately eight hours and was downloaded over 4,000 times before being removed by maintainers. 

How the Attack Occurred

• Vector: Attackers exploited a compromised npm publish token. This token was likely leaked during a prior GitHub Actions prompt injection vulnerability (referred to as “Clinejection”) reported by researcher Adnan Khan.
• Mechanism: The malicious package included a modified package.json file with a postinstall script. This script automatically executed npm install -g openclaw@latest upon the installation of Cline CLI.
• Targeting: The attack specifically affected the CLI version on npm. The Visual Studio Code extension and JetBrains plugin remained unaffected as they use different distribution channels. 

The Role of OpenClaw

While OpenClaw is a legitimate open-source autonomous AI agent, its unauthorized installation is highly concerning due to its broad system access: 

• Deep Integration: OpenClaw can interface with messaging apps (Slack, Discord, WhatsApp) and execute terminal commands.
• Security Risks: At the time of the attack, OpenClaw was already facing its own security crisis, including CVE-2026-25253, a critical remote code execution (RCE) vulnerability.
• “The Agent is the Implant”: Security researchers noted that while OpenClaw itself is not “malware” in the traditional sense, forcing its installation on developer systems creates a massive, unauthorized attack surface. 

Remediation Steps

If you installed or updated the Cline CLI on February 17, 2026, take these actions:

1. Update Cline: Ensure you are on version 2.4.0 or higher, which removed the malicious script.
2. Uninstall OpenClaw: Manually check for and remove the global installation using npm uninstall -g openclaw.
3. Audit Environment: Check for any unusual activity or autonomous agents running in the background. 

Cline maintainers have since revoked the compromised token and moved to OIDC (OpenID Connect) for trusted publishing via GitHub Actions to prevent future unauthorized releases.