GHSA-9ppg-jx86-fqw7: unauthorized npm release of cline@2.3.0
The maintainers' advisory says someone without authorization used a compromised npm publish token to release cline@2.3.0 on 17 February 2026 with an added install step that globally installed another package, openclaw; version 2.4.0 replaced it about eight hours later and the token was revoked.
The record
- Kind
- Disclosure
- Source record
- GHSA-9ppg-jx86-fqw7: Unauthorized npm publish of cline@2.3.0 with modified postinstall script (OSV copy of the GitHub advisory) (GitHub-reviewed advisory via OSV)
- Record published
- 2026-02-19
- Posted here
- 2026-10-21
- World
- Software agents · Enterprise work agents
- Controls concerned
- Least-privilege credential scoped to task C-E1; Provenance of the actor's software and hardware C-A3
- Related case
- Claude Code GitHub Action, in agent mode, trusted any GitHub App actor (a name ending in [bot]): a route from a public issue to repository write access, reported January 2026 REG-0024
- Checked
- Checked against its record on 2026-10-22 by a reader who did not draft it; report
verification/reports/SIG-2026-10-21-002-2026-10-22.md.
A signal's controls are the ones its record points at, the exposure; a case's controls are the ones its records show were absent or failed, so the two can differ.
What a signal is. A signal records what a primary record says; it assigns no fault. It is lighter than a case: one dated item from one record, tagged with the world, sector and controls it touches. It becomes a case when it meets the bar for one.
New signals like this, once a week. A short email when a case, signal or rule touches software agents. Free; unsubscribe in one click.
Get the weekly emailNewer: UK AI Security Institute incident report: agents in a cyber evaluation