Cline AI triage bot tricked by prompt injection to publish malicious npm package
A prompt injection attack targeting Cline's AI issue triage bot led to the theft of npm publishing tokens. This allowed an attacker to publish a compromised version of the Cline CLI that installed an unauthorized AI agent on approximately 4,000 developer machines.
The attack demonstrated a complete supply chain compromise from issue triage to package publication.
Key facts
- What
- A prompt injection attack targeting Cline's AI issue triage bot led to the theft of npm publishing tokens.
- Incident date
- Feb 17, 2026
- Who
- Cline
- Failure mode
- Prompt Injection
- AI surface
- Chatbot
- Severity
- High
What happened
An attacker used a malicious GitHub issue title to perform a prompt injection against the Claude-powered triage bot. The bot was manipulated into executing commands that stole npm publishing tokens via GitHub Actions cache poisoning. The attacker then published Cline CLI version 2.3.0, which silently installed the OpenClaw AI agent on systems that updated the package.
What broke inside the model
- 01 · TriggerThe model reads retrieved or user-supplied text.
- 02 · Model stepThat text carries hidden instructions.
- 03 · Control gapNothing separates untrusted data from trusted commands.
- 04 · FailureThe injected instruction overrides the operator's.
- 05 · ConsequenceThe system acts on an outsider's intent.
At the injection point, retrieved text overrides the operator's instruction.
The triage bot processed user-supplied issue titles as direct AI input without sanitization. Because the agent had excessive permissions within the GitHub Actions environment, it could be tricked into compromising the CI/CD pipeline.
What it cost
Sources
- SocialSupply Chain Attack targeting Cline installs OpenClawendorlabs.com
- SocialCline CLI 2.3.0 Supply Chain Attack: OpenClaw Unauthorized Installation on Developer and CI/CD Systemsrescana.com
- SocialCline CLI Supply Chain Attack via Prompt Injectiongithub.com
Cite this entry
https://failureindex.ai/failures/cline-triage-bot-tricked-prompt-injectionAI Failure Index. "Cline AI triage bot tricked by prompt injection to publish malicious npm package" (FI-0462). Realm Labs. https://failureindex.ai/failures/cline-triage-bot-tricked-prompt-injection (indexed Jun 10, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0462. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
Realm inspects the model's internal state for the signature of instructions arriving through the data channel, so an injected command can be flagged and blocked inline before the model acts on it, instead of trusting a classifier that scores the input as safe.