Cline CLI 2.3.0 Supply Chain Attack Installed OpenClaw on Developer Systems
· Source: datacentremagazine.com
In short
A software supply chain attack targeted the AI-powered coding assistant Cline CLI, where an unauthorized party used a compromised npm publish token to release version 2.3.0 containing a postinstall script that automatically installed the OpenClaw autonomous AI agent on developer systems. The attack occurred during an eight-hour window on February 17, 2026, affecting approximately 4,000 downloads, though the impact is considered low as OpenClaw itself is not malicious. The incident highlights vulnerabilities in AI agent workflows, including prompt injection attacks like Clinejection that can compromise publication secrets and enable supply chain attacks.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 8, 2026: Agentic AI and Automation Drive 20%+ Gains in Supply Chain Execution
Tags: supply-chain, security, automation, cybersecurity, devops, ai-agents