Malicious Cline 2.3.0 Release Silently Installed OpenClaw
Summary
StepSecurity reports that cline 2.3.0, published on npm on Feb. 17, contained a post-install script that silently installed OpenClaw. About 4,000 downloads were recorded before maintainers deprecated it roughly eight hours later.
Key points
- StepSecurity detected the suspicious release 14 minutes after publication; Adnan Khan is also credited with independently discovering and reporting the incident.
- Unlike earlier releases, cline 2.3.0 was published manually and lacked npm provenance attestations, according to StepSecurity.
- The package contained a post-install command that installed OpenClaw globally without user disclosure.
- The affected version recorded approximately 4,000 downloads and was deprecated about eight hours after release; maintainers also released a clean version.
- Systems that installed the affected version during the exposure window may have received OpenClaw. The article says its persistent gateway can access user-accessible secrets and execute shell commands, but does not report confirmed attacker use.
- The article recommends upgrading to cline 2.4.0 or later and checking for and removing an unintended OpenClaw installation.
Article Details
- Victim Organization
- Cline (npm package project)
- Victim Domain
- cline.bot
- Incident Type
- Software supply chain attack involving an unauthorized [email protected] release with a malicious post-install script that silently installed OpenClaw
- Incident Date
- 2026-02-17
- Disclosure Date
- 2026-02-18
- Data Types Exposed
- Potentially accessible credentials and secrets, including API keys, OAuth tokens, environment variables, .env files, SSH keys, cloud credentials, and GitHub tokens; no data theft is confirmed in the article.
- Affected Records
- Approximately 4,000 downloads of [email protected] were recorded; the number of affected installations or individuals was not disclosed.
- Operational Impact
- Machines or CI/CD environments that installed [email protected] during the approximately eight-hour exposure window could have had OpenClaw installed globally. The article describes its persistent background gateway and potential access to credentials and arbitrary command execution, but does not confirm those capabilities were used or that data was stolen.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
MITRE ATT&CK
T1195.002 · Compromise Software Supply ChainThe [email protected] package was published with a malicious post-install script that installed OpenClaw, constituting a software supply chain compromise.T1543.001 · Launch AgentThe article says OpenClaw installs a persistent Gateway daemon via launchd on macOS.T1543.002 · Systemd ServiceThe article says OpenClaw installs a persistent Gateway daemon via systemd on Linux.
CVE
People
Vendors
Products
Cline17, 2026 at 11:40 UTC, the StepSecurity npm monitoring system detected a suspicious release of the cline npm package. Version 2.3.0 of this widely-used autonomous coding agent CLI was published with a maliciousGitHub ActionsAll prior legitimate releases of cline were published via GitHub Actions using OIDC-based Trusted Publishing — a strong provenance mechanism that ties package releases directly to verifiable CI/CD pipeline identities:npmOn February 17, 2026 at 11:40 UTC, the StepSecurity npm monitoring system detected a suspicious release of the cline npm package. Version 2.3.0 of this widely-used autonomous coding agent CLI was published with aOpenClawagent CLI was published with a malicious post-install script that silently installs a secondary package, openclaw, on any machine that ran npm install cline.