# cline npm package hijacked via "Clinejection" prompt-injection chain

> An attacker abused an unsanitised AI issue-triage GitHub Actions workflow on the Cline repo to poison the release pipeline cache and steal the npm publish token. They published `cline@2.3.0` with a postinstall script that globally installed the second-stage package `openclaw`. ~90k weekly downloads; live for ~8 hours before Cline rotated the token and shipped 2.4.0.

- Published: 2026-02-17
- Severity: high
- Kind: Compromise - A legitimate, already-used package, maintainer account, CI pipeline, or release tag was hijacked and a malicious version was published under a name people already depend on.
- Ecosystems: npm
- Scope: 1 package, 1 compromised version
- Tags: prompt-injection, ci-cd-compromise, account-takeover
- Also known as: Clinejection
- Detected by: Socket
- Incident ID: npm-2026-02-17-cline-clinejection

## Affected packages (1)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [cline](https://dependencywatch.io/package/npm/cline) | npm | 2.3.0 |

## What happened

Cline is a popular npm-distributed AI coding assistant (≈90,000 weekly downloads at the time of incident). On February 17, 2026, Socket disclosed that an attacker had abused the Cline repo's AI-driven issue-triage GitHub Actions workflow to insert content the bot would render as legitimate maintainer instructions - a textbook second-order prompt-injection chain that ended in npm publish-token theft.

The attacker filed a crafted issue. The AI triage workflow ingested the issue body, the prompt-injection content steered it into modifying the release-pipeline cache, and the next push of `cline` shipped from a poisoned cache. The published `cline@2.3.0` carried a `postinstall` script that globally installed a second-stage package, `openclaw`, which contained the actual malware.

The live window was roughly eight hours. Cline rotated the npm token, yanked `2.3.0`, and pushed `2.4.0` once the chain was understood. There is no clean way to know how many of the ~90k weekly users updated during the window; assume any host that resolved `cline@2.3.0` should be treated as suspect.

This is the first publicly-documented prompt-injection-to-npm-publish chain mediated by an AI triage bot, and it set the template for several subsequent attacks (see `multi-2026-04-29-promptmink-validate-sdk`). The defensive takeaway: AI bots with any write access to publication workflows are a publish-token equivalent. Don't give them that access.

## Impact

- Developers who installed cline@2.3.0 had `openclaw` silently installed globally
- First publicly-documented prompt-injection-to-npm-publish chain via an AI triage bot
- 5M+ potential AI-coding-tool users exposed during the window

## What to do

1. Pin `cline` ≥ 2.4.0; uninstall any global `openclaw` package
2. Audit AI-driven issue triage workflows for unsanitised inputs
3. Disable AI bots that have write access to publication workflows

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [Socket: Cline CLI npm package compromised](https://socket.dev/blog/cline-cli-npm-package-compromised-via-suspected-cache-poisoning-attack) - Socket

---

Canonical page: https://dependencywatch.io/incident/npm-2026-02-17-cline-clinejection
Markdown version: https://dependencywatch.io/incident/npm-2026-02-17-cline-clinejection.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).