How Cline’s Issue-Triage Agent Became a Route to npm Publishing

On February 9, security researcher Adnan Khan disclosed Clinejection, a flaw in Cline’s automated GitHub issue-triage workflow. Added on December 21, 2025, the workflow gave an AI agent shell access while inserting user-controlled issue text into its prompt. Khan reproduced the prompt injection in a mirror of the repository.

The triage job shared GitHub Actions cache scope with a nightly publishing workflow. Khan showed how code execution in the lower-privilege job could poison cache entries later restored by the workflow holding release credentials. Cline removed the vulnerable workflow and changed its publishing setup after the disclosure.

The unauthorized npm release happened later. On February 17, a still-active npm token was used to publish Cline CLI version 2.3.0. Cline’s postmortem says the token remained active because the wrong token had been deleted during rotation. The package added a postinstall script that installed OpenClaw, a legitimate open-source project. Cline deprecated the version and published 2.4.0 about eight hours later. It reports that the VS Code and JetBrains extensions were unaffected and that no malicious code or user-data exfiltration was observed.

Khan linked the unauthorized publish to exploitation of the flaw. Cline’s postmortem confirms the still-active token was used after a failed rotation, but does not identify the publisher or report user-data theft.

Useful safeguards follow from the chain:

• Keep shell tools away from untrusted issue text in automated triage
• Isolate caches used by untrusted jobs from workflows holding release credentials
• Verify revocation of the specific token, rather than relying only on a dashboard summary