Supply Chain Attack targeting Cline installs OpenClaw

A compromised release of the Cline AI assistant's CLI npm package, version 2.3.0, was detected, which uses a post-install hook to automatically install the benign OpenClaw package, resulting in a low-impact security incident. The breach was reported by Adnan Khan and is tracked as GHSA-9ppg-jx86-fqw7. The attacker appears to have published the malicious version by accessing a long-lived token, circumventing the Cline maintainers' trusted publication process. Although the attack affected many machines due to high download counts, the impact was minimized since OpenClaw is not malicious, and the Gateway daemon was not installed or started. The incident underscores the importance of disabling publication through traditional tokens and paying attention to package attestations. The detection of this malware by an AI-based analysis pipeline highlights the effectiveness of differential analyses in identifying malicious characteristics, such as the addition of a post-install hook and the absence of provenance information. Users are advised to check their version of Cline and update to the latest version, 2.4.0, removing OpenClaw if necessary.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.