Prompt injection in Cline's Claude issue-triage bot leads to an unauthorised npm release
Cline ran a GitHub Actions workflow in which Claude triaged new issues with shell access; any GitHub user could trigger it, and a crafted issue title could make the agent run arbitrary code. Researcher Adnan Khan showed this could be chained through Actions cache poisoning to reach release credentials, and on 17 February 2026 an unknown party used an npm token that Cline had failed to revoke to publish cline@2.3.0, which silently installed the OpenClaw agent and was downloaded about 4,000 times. Cline removed the AI triage workflows, revoked the token and moved to OIDC-based publishing.
Khan reported the flaw privately on 1 January 2026 and disclosed it publicly on 9 February; during rotation Cline deleted the wrong npm token, leaving the exposed one active. Cline says the CLI binary was otherwise identical, no malicious code was delivered, and its VS Code and JetBrains extensions were unaffected.
What would have stopped it
Never give an agent that reads untrusted input shell access in a pipeline that can reach release credentials.
Guardrails
- G1 Least privilege Failed The triage agent had Bash and write tools and ran in the default-branch cache scope used by releases.
- G2 Human confirmation Failed Any GitHub user could trigger the agent, and its shell commands ran without human approval.
- G3 Isolation Failed The triage workflow shared a GitHub Actions cache with the nightly release workflow holding publish secrets.
- G4 Instruction integrity Failed Issue titles were inserted into Claude's prompt; Claude executed the injected payload in every test.
- G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
- G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
- G7 Oversight Partial StepSecurity flagged the release, which lacked provenance; Cline deprecated it about eight hours later.
- G8 Recovery Partial Cline shipped 2.4.0 and deprecated 2.3.0, but users had to uninstall OpenClaw themselves.
Sources
-
“Clinejection demonstrates an in-the-wild example of how AI agent vulnerabilities become the entry point for traditional CI/CD exploitation.”
-
“On February 17, a third party used the still-active token to publish cline@2.3.0 with the openclaw postinstall script.”
-
“The affected version was downloaded approximately 4,000 times before the package maintainers deprecated it roughly 8 hours after its release.”
Confidence 95% comes from these sources alone. How we score
History
- 14 Oct 2026Entered in the register with 3 sources