AI Risk Wire

Cases › security breach › LR-2026-0398

Cline CLI supply chain attack installs OpenClaw on developer systems

Confirmed Why: StepSecurity research · StepSecurity · 1 independent report

Status: advice only, no fix reported

Severity moderate
Reported 17 Feb 2026
Developer and model Cline

No source states: loss or records, agent tool, could do, deployer, industry.

Severity moderate: Test: moderate, data or systems of others touched with a bounded scope stated. Developer and CI/CD machines of others may have received an unwanted openclaw install, bounded to cline 2.3.0 and the roughly 8-hour window.

The cline CLI, an open-source autonomous coding agent tool, published version 2.3.0 to npm on February 17, 2026. That release carried a post-install script that silently installed the separate openclaw package on machines that ran npm install cline. The version was published by a user account rather than through the project's trusted-publishing pipeline, and it lacked npm provenance attestations. StepSecurity's npm monitoring flagged the release as suspicious within minutes of publication. The maintainers deprecated the version roughly eight hours after release, after about 4,000 downloads. Endor Labs assessed openclaw itself as benign and noted that the Gateway daemon was not started. Users were advised to update to 2.4.0 and remove openclaw.

What happened

1 · What went wrongVersion 2.3.0 was published with a post-install script that silently installed openclaw.
2 · How it was caughtStepSecurity's npm monitoring flagged the release as suspicious.

What was done

The maintainers deprecated the version about eight hours after release.
Advice in source, not a fix by the party

“The NPM Cooldown check automatically fails a pull request if it introduces an npm package version that was released within the organization’s configured cooldown period (default: 2 days).”

Vetting of plug-ins, skills and dependencies

Risks

Supply-chain compromise
Primary24 incidents
Rising: 4 vs 0.2 a week
Credential and privilege abuse
Also37 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Sandboxed code execution

Application

Signed and verified components · Vetting of plug-ins, skills and dependencies · AI bill of materials · Vulnerability scanning of AI components · Model provenance checks · Least-privilege access for the agent

Infrastructure / target

Secrets scanning

Evidence

No source states: what the AI was doing, what it reached or did, when it happened, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 2 items from the primary sources

What happened, in order

Not dated in the sources:

  • Detection occurred within minutes of publication, per StepSecurity.
  • After the incident, the malicious version was flagged while its tarball and metadata remained available.
Show every field, with its source and grade

The AI system

Developer
Cline
C one secondary source states it
What it was for
Autonomous coding agent CLI for AI-assisted software development
C one secondary source states it

What happened

Earliest source we hold
2026-02-17
D inferred by us from the described behaviour, reason shown
How long it lasted
PT8H
C one secondary source states it
Who caught it
automated monitoring
C one secondary source states it
Cause in detail
The attacker supposedly obtained a long-lived npm token to publish the malicious version
C one secondary source states it
What was done
Update to version 2.4.0 or higher and remove openclaw with npm uninstall -g openclaw
C one secondary source states it
What went wrong
security breach
C one secondary source states it
primary risk
RK06
D inferred by us from the described behaviour, reason shown
secondary risks
RK03
D inferred by us from the described behaviour, reason shown
remediations
kind: advice; controls added: G3; quote: The NPM Cooldown check automatically fails a pull request if it introduces an npm package version that was released within the organization’s configured cooldown period (default: 2 days).; source index: 0
C one secondary source states it

Impact

Severity
moderate
D inferred by us from the described behaviour, reason shown
Kind of harm
others' security
C one secondary source states it
Can it be undone
yes
C one secondary source states it
Why this severity
Test: moderate, data or systems of others touched with a bounded scope stated. Developer and CI/CD machines of others may have received an unwanted openclaw install, bounded to cline 2.3.0 and the roughly 8-hour window.
D inferred by us from the described behaviour, reason shown

Notes on gaps

The StepSecurity cooldown advice is product promotion, cited as advice.

LR-2026-0398 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON