ManifoldAgent incident ledger
← All incidents timeline

Suggest a change

About Cline's AI issue-triage agent is injectable; a stolen npm token later ships cline@2.3.0

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

Cline· Issue-triage workflow running Claude through claude-code-action

Cline's AI issue-triage agent is injectable; a stolen npm token later ships cline@2.3.0

A researcher showed Cline's GitHub issue-triage agent could be prompt-injected to run attacker code; eight days after disclosure an attacker used a still-valid npm token to publish cline@2.3.0, which installed OpenClaw, but no source confirms the token was taken through the agent.

Cline added a triage workflow on 21 December 2025 in which Claude could run shell commands on any new issue. Researcher Adnan Khan reported it on 1 January 2026 and disclosed it publicly on 9 February; in a mirror of the repository he showed the agent running an injected npm install. Cline fixed the workflow within about 30 minutes and rotated credentials, but deleted the wrong npm token. On 17 February an unauthorised party published cline@2.3.0 with a postinstall script that installs OpenClaw, live for about eight hours; StepSecurity reports about 4,000 downloads. Cline's post-mortem and Khan's write-up describe how the chain could work but do not say how the token was actually obtained.

First incident action to disclosure
50 days
First incident action to discovery
11 days
Noticed first by
Someone else
Caught
An outside report

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. 21 Dec 2025

    First incident action

    Cline adds a triage workflow where Claude can run shell commands on any user's issue

    The workflow used claude-code-action and let any GitHub user trigger it.

  2. 1 Jan 2026

    Adnan Khan reports the vulnerability privately

    Follow-ups on 8 and 18 January and 7 February are reported by Khan as unanswered. Cline says the report was not addressed until public disclosure.

  3. 1 Jan 2026

    Handler found out · 11 days in

    The handler finds out

    Khan's private report. Cline says it was not addressed until the public disclosure; Khan says he got no substantive reply.

  4. 9 Feb 2026

    Disclosed · 50 days after the first incident action

    Khan publishes Clinejection; Cline removes the workflows within about 30 minutes and starts rotating credentials

    Khan says in his own test, in a mirror repository, Claude executed the injected payload every time. The wrong npm token was deleted, leaving the exposed one active.

  5. 17 Feb 2026

    An unauthorised party publishes cline@2.3.0 using a still-valid npm token

    It added a postinstall running npm install -g openclaw@latest; the CLI binary was identical to 2.2.3. Published 3:26 AM PT, live about eight hours. StepSecurity reports about 4,000 downloads, which counts downloads, not confirmed installs.

    Reports differ

    How the token was obtained is not confirmed. Khan, Snyk and Grith present the agent-to-cache-poisoning chain as the likely route; Cline and SafeDep do not confirm it.

    • The token was taken through the injected triage agent and cache poisoning.
    • The theft method is not publicly confirmed.

  6. 17 Feb 2026

    Cline publishes 2.4.0, deprecates 2.3.0 and revokes the token

    Also removes AI triage and Actions cache use from publish workflows, rotates all publication credentials and moves npm to OIDC.

Agent failures

Prompt injection / context poisoning, Supply chain compromiseShow
Map to frameworks

  • Prompt injection / context poisoning

    An issue title was inserted into the agent's prompt; in Khan's test it made the agent run an attacker command.

  • Supply chain compromise

    An unauthorised cline@2.3.0 reached npm with a postinstall that installs OpenClaw. The route from the agent to the token is not confirmed.

How it was found

Found first by someone else, from an outside reportShow
Found first by
Someone else
How
An outside report
Found to disclosed
39 days

The vulnerability was found by an outside researcher, Adnan Khan, who reported it on 1 January 2026 and went public on 9 February after follow-ups went unanswered. The unauthorised cline@2.3.0 was flagged by StepSecurity's monitoring about 14 minutes after publish and by SafeDep's tooling; Cline's post-mortem does not say how Cline learned of it.

What is publicly known

2 of 12 fully publicShow
2 of 12 fully public
ItemPublic?DetailSources
PartialDescribed as Claude via Anthropic's claude-code-action; no model version stated in what we read.
UnknownNothing public.
PartialKhan says Claude had Bash, Write and Edit tools and no inspection of the command it ran.
UnknownThe workflow prompt is described (issue title inserted directly) but not published verbatim in what we read.
PartialTriage of new GitHub issues; the injected title is described, not reproduced here.
Knownclaude-code-action in GitHub Actions, any user could trigger it, Bash, Write and Edit enabled.
UnknownNo egress policy described.
UnknownNo agent transcripts from the live repository published.
PartialStepSecurity says it flagged the release about 14 minutes after publish; Khan points to suspicious nightly failures from 31 January to 3 February.
Partialcline@2.3.0 live about eight hours; about 4,000 downloads per StepSecurity; payload described as benign; VS Code and JetBrains extensions unaffected.
WeakCline describes the chain but not how the token was taken. Khan: unclear if the triage workflow was the vector.
KnownAI triage removed, Actions cache removed from publish workflows, all credentials rotated, OIDC publishing, rotation verified against the real credential.

Controls that apply

  • Govern

    Vet, pin and change-control what agents load

    cline@2.3.0 was published manually from a user account rather than the trusted pipeline, with a postinstall running npm install -g openclaw@latest. A pinned version, or a check for provenance from the trusted pipeline, would have flagged it for those installing; StepSecurity flagged it about 14 minutes after publish.

  • Identify

    Test adversarially before release

    The workflow went live on 21 December 2025 giving shell access to any issue author, and an outside researcher found the injection; in his mirror test Claude ran the injected payload every time. A prompt-injection test before release would have surfaced the same result.

  • Protect

    Treat what the agent reads as untrusted

    Any GitHub user could open an issue that the triage agent read with shell access, and in Khan's mirror test an injected issue title made Claude run npm install against an attacker's commit every time. Treating issue text as data would have kept it from triggering a shell command.

  • Give each agent the least agency its task needs

    The triage workflow let Claude run shell commands on any new issue, more than triaging needs. Without a shell, the injected npm install in Khan's test had nothing to run on. Cline has since removed AI triage from its workflows.

  • Give agents their own scoped, short-lived credentials

    A long-lived npm publish token was reachable from CI, stayed valid after rotation and was used to publish cline@2.3.0. Cline now publishes with OIDC provenance and no long-lived npm token. No source confirms the token was taken through the agent.

  • Detect

    Record every agent action, outside the agent

    In Khan's test the agent ran npm install against an attacker-chosen commit. A record of the triage agent's shell commands, kept outside the workflow, would show whether that happened on the live repository, which no source establishes.

  • Respond

    Contain, notify and disclose

    Khan's private report of 1 January went unanswered through three follow-ups until public disclosure on 9 February. Cline then rotated credentials but deleted the wrong npm token, leaving the exposed one active, and it was used on 17 February.

  • All controls →

Coverage and commentary

2 statements, 3 articlesShow

What the parties involved said

  • Adnan Khan

    Says it is unclear whether the attacker's initial vector was the triage workflow, but it is the most obvious path; says a different actor found his proof of concept and used it.

  • Cline

    Describes the attack chain as possible, does not state how the token was obtained, and removed AI triage and cache use from publish workflows.

All 6 sources

  1. Primary source

    Post-mortem: Unauthorized Cline CLI npm publish ↗Cline · 2026-02-24

  2. Primary source

    Clinejection ↗Adnan Khan · 2026-02-09

  3. Primary source

    Unauthorized npm publish of Cline CLI cline@2.3.0 (GHSA-9ppg-jx86-fqw7) ↗GitHub Security Advisory · 2026-02-17

  4. Press

    Cline 2.3.0 silently installs OpenClaw ↗StepSecurity · 2026-02-17

  5. Commentary

    AI Agent Cline v2.3.0 Compromised: From Prompt Injection to Unauthorized npm Publish ↗SafeDep · 2026-02-18

  6. Commentary

    A GitHub issue title compromised 4,000 developer machines ↗grith.ai · 2026-03-05

Entry id cline-clinejection-npm-2026 · overall Disputed · impact serious