ai-agents developer-tools software-vulnerabilities npm-security

A GitHub Issue Title Compromised 4k Developer Machines

A GitHub Issue Title Compromised 4,000 Developer Machines

grith.ai

March 5, 2026

6 min read

🔥🔥🔥🔥🔥

70/100

Summary

On February 17, 2026, a malicious version of the Cline package was published to npm, which included a code change in the package.json file that executed a post-install command to install OpenClaw, an AI agent with full system access. This led to approximately 4,000 developer machines being compromised as users installed or updated the Cline package without consent.

Key Takeaways

An attacker exploited a vulnerability in a GitHub issue title to inject a command that installed a malicious package, OpenClaw, on 4,000 developer machines via npm.
The attack, named "Clinejection," involved a chain of vulnerabilities including prompt injection, cache poisoning, and credential theft, ultimately allowing the attacker to publish a compromised version of the Cline package.
The vulnerability was reported by a security researcher in January 2026, but the Cline team failed to respond adequately, leading to the successful exploitation of the npm token.
The incident highlights a new pattern where one AI tool can inadvertently install another AI agent on developer machines, raising concerns about security in AI-driven workflows.

Read original article

View story →

Coverage & discussions

Hacker News · grith.ai

A GitHub Issue Title Compromised 4k Developer Machines ↗

Community discussions

Hacker News discussion ↗

Historical count: 5 · 5 saved in sample · Historical sample

Analysis ready

Community Sentiment

Mixed

Positives

The incident highlights the critical need for AI developers to implement robust input sanitization to prevent vulnerabilities similar to SQL injection attacks, which is essential for maintaining security.

Concerns

The GitHub Actions system is criticized for doing too much, suggesting that its complexity may introduce significant security risks that could compromise developer environments.
The article fails to provide new insights into the vulnerability, indicating a lack of depth in reporting that could mislead readers about the severity of the issue.