{"schema_version":"0.10.0","id":"LR-2026-0398","record_version":1,"title":"Cline CLI supply chain attack installs OpenClaw on developer systems","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":57.2,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":5.76,"unhedged_language":4.5},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"StepSecurity research","original_document":{"url":"https://www.stepsecurity.io/blog/cline-supply-chain-attack-detected-cline-2-3-0-silently-installs-openclaw","organisation":"StepSecurity","role":"researcher"},"reports_total":2,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"StepSecurity research"}]},"sources_hash":"8e2740e43479b0db8850a7221f5ab8286a6688092a282b44d11b4e4d070242a1"},"system":{"model_name":null,"model_version":null,"developer":"Cline","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"Autonomous coding agent CLI for AI-assisted software development","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-02-17","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":"PT8H","detection_method":"automated_monitor","summary":"The cline CLI, an open-source autonomous coding agent tool, published version 2.3.0 to npm on February 17, 2026. That release carried a post-install script that silently installed the separate openclaw package on machines that ran npm install cline. The version was published by a user account rather than through the project's trusted-publishing pipeline, and it lacked npm provenance attestations. StepSecurity's npm monitoring flagged the release as suspicious within minutes of publication. The maintainers deprecated the version roughly eight hours after release, after about 4,000 downloads. Endor Labs assessed openclaw itself as benign and noted that the Gateway daemon was not started. Users were advised to update to 2.4.0 and remove openclaw.","tags":[],"date_detected":"2026-02-17","near_miss":null,"root_cause":null,"root_cause_detail":"The attacker supposedly obtained a long-lived npm token to publish the malicious version","failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"Update to version 2.4.0 or higher and remove openclaw with npm uninstall -g openclaw","precursor_events":null,"primary_risk":"RK06","secondary_risks":["RK03"],"remediations":[{"by":null,"kind":"advice","date_reported":null,"controls_added":["G3"],"quote":"The NPM Cooldown check automatically fails a pull request if it introduces an npm package version that was released within the organization’s configured cooldown period (default: 2 days).","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: moderate, data or systems of others touched with a bounded scope stated. Developer and CI/CD machines of others may have received an unwanted openclaw install, bounded to cline 2.3.0 and the roughly 8-hour window.","harm_class":["third_party_security"],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":"reversible","downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.stepsecurity.io/blog/cline-supply-chain-attack-detected-cline-2-3-0-silently-installs-openclaw","publisher":"Step Security","date":"2026-02-17","type":"press","title":"Cline Supply Chain Attack Detected: cline@2.3.0 Silently Installs OpenClaw - Step Security","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.endorlabs.com/learn/supply-chain-attack-targeting-cline-installs-openclaw","publisher":"Endor Labs","date":"2026-02-18","type":"press","title":"Supply Chain Attack targeting Cline installs OpenClaw - Endor Labs","archived_url":null}],"per_field_confidence":{"system.developer":"C","system.intended_use":"C","event.date_detected":"C","event.incident_class":"C","event.detection_method":"C","event.root_cause_detail":"C","event.duration":"C","event.remediation":"C","impact.harm_class":"C","impact.reversibility":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.remediations":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":1,"quote":"The Cline maintainers enabled trusted publishing, which is considered a best practice: It allows publishing packages from trusted platforms like GitHub or GitLab using short-lived OICD tokens, as opposed to using traditional tokens, which have been compromised again and again to publish malicious versions."}],"system.intended_use":[{"source_index":0,"quote":"cline is a popular open-source autonomous coding agent CLI tool that enables AI-assisted software development tasks — including file creation and editing, running terminal commands, and browser interaction."}],"event.date_detected":[{"source_index":0,"quote":"On February 17, 2026 at 11:40 UTC, the StepSecurity npm monitoring system detected a suspicious release of the cline npm package."}],"event.incident_class":[{"source_index":0,"quote":"Version 2.3.0 of this widely-used autonomous coding agent CLI was published with a malicious post-install script that silently installs a secondary package, openclaw, on any machine that ran npm install cline."}],"event.detection_method":[{"source_index":0,"quote":"StepSecurity continuously tracks package releases across npm registries, verifying release patterns and provenance signals."}],"event.root_cause_detail":[{"source_index":1,"quote":"As visible from the metadata, the attacker supposedly got hold of a long-lived token to publish the malicious version, thereby bypassing the trusted publication process established by the Cline maintainers."}],"event.duration":[{"source_index":0,"quote":"The affected version was downloaded approximately 4,000 times before the package maintainers deprecated it roughly 8 hours after its release."}],"event.remediation":[{"source_index":1,"quote":"If yes, update to the latest version (2.4.0) and remove OpenClaw using npm uninstall -g openclaw."}],"impact.harm_class":[{"source_index":0,"quote":"Version 2.3.0 of this widely-used autonomous coding agent CLI was published with a malicious post-install script that silently installs a secondary package, openclaw, on any machine that ran npm install cline."}],"impact.reversibility":[{"source_index":1,"quote":"If yes, update to the latest version (2.4.0) and remove OpenClaw using npm uninstall -g openclaw."}],"impact.severity":[{"source_index":0,"quote":"Any developer or CI/CD system that ran npm install cline (or an equivalent command without version pinning) during the ~8-hour window may have had openclaw installed on their machine or build environment."}],"impact.severity_because":[{"source_index":0,"quote":"Any developer or CI/CD system that ran npm install cline (or an equivalent command without version pinning) during the ~8-hour window may have had openclaw installed on their machine or build environment."}],"event.remediations":[{"source_index":0,"quote":"The NPM Cooldown check automatically fails a pull request if it introduces an npm package version that was released within the organization’s configured cooldown period (default: 2 days)."}],"event.summary":[{"source_index":0,"quote":"Version 2.3.0 of this widely-used autonomous coding agent CLI was published with a malicious post-install script that silently installs a secondary package, openclaw, on any machine that ran npm install cline."},{"source_index":0,"quote":"Version 2.3.0, however, was published manually by a user account:"},{"source_index":0,"quote":"Version 2.3.0 lacked these attestations entirely, meaning there was no way to verify where or how the package was built."},{"source_index":0,"quote":"On February 17, 2026 at 11:40 UTC, the StepSecurity npm monitoring system detected a suspicious release of the cline npm package."},{"source_index":0,"quote":"The affected version was downloaded approximately 4,000 times before the package maintainers deprecated it roughly 8 hours after its release."},{"source_index":1,"quote":"Overall impact is considered low, despite high download counts: OpenClaw itself is not malicious, and the installation does not include the installation/start of the Gateway daemon."},{"source_index":1,"quote":"If yes, update to the latest version (2.4.0) and remove OpenClaw using npm uninstall -g openclaw."}]},"notes_on_gaps":"No AI model or model version is named; the harm arises from an npm post-install script, so agent_involved is set false as a judgement and no failure_class is given. The attacker is not identified, so adversarial_actor and responsible_party are omitted. The trigger is not stated as a cause (sources say the token was supposedly obtained), so event.trigger and root_cause are omitted; the root_cause_detail uses the hedged Endor wording. Publication time is given only as Feb 17 03:26 PT from registry metadata in a table, so date_occurred uses the detection date sentence. The disclosure date is not stated and is omitted. Duration PT8H is derived from the source's 'roughly 8 hours' and treated as approximate. Download count (approximately 4,000) is not a count of affected parties, so third_parties_affected_count is omitted. Severity 'moderate' is a judgement under the bounded-scope test; Endor rates overall impact as low. The StepSecurity cooldown advice is product promotion, cited as advice. Country, industry, deployment context, lifecycle stage, tools granted and permissions were not stated and are omitted. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (StepSecurity research)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"Version 2.3.0 was published with a post-install script that silently installed openclaw.","quote":"Version 2.3.0 of this widely-used autonomous coding agent CLI was published with a malicious post-install script that silently installs a secondary package, openclaw, on any machine that ran npm install cline.","source_index":0,"grade":"C"},{"step":"caught","text":"StepSecurity's npm monitoring flagged the release as suspicious.","quote":"On February 17, 2026 at 11:40 UTC, the StepSecurity npm monitoring system detected a suspicious release of the cline npm package.","source_index":0,"grade":"C"},{"step":"done","text":"The maintainers deprecated the version about eight hours after release.","quote":"The affected version was downloaded approximately 4,000 times before the package maintainers deprecated it roughly 8 hours after its release.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.stepsecurity.io/blog/cline-supply-chain-attack-detected-cline-2-3-0-silently-installs-openclaw","https://www.endorlabs.com/learn/supply-chain-attack-targeting-cline-installs-openclaw"]},"analysis":{"sections":{"timeline":[{"text":"Detection occurred within minutes of publication, per StepSecurity.","quote":"Our detection systems identified this attack within minutes of publication, providing early warning before widespread exploitation.","source_index":0,"when":null},{"text":"After the incident, the malicious version was flagged while its tarball and metadata remained available.","quote":"The malicious version has been flagged in the meantime, but the tarball and metadata are still available at the time of writing.","source_index":1,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.stepsecurity.io/blog/cline-supply-chain-attack-detected-cline-2-3-0-silently-installs-openclaw","https://www.endorlabs.com/learn/supply-chain-attack-targeting-cline-installs-openclaw"]}}