The Consequence Library · How records are made and graded
A crafted GitHub issue title manipulated the Cline repository's AI issue-triage bot into executing arbitrary code, ultimately yielding the npm publish token and producing an unauthorised release of the official package that auto-installed a separate AI agent on any system that installed or updated it.
Evidence caveat. Figures circulating for the number of affected developer machines appear only in lower-tier sources and are not reproduced here. The package was live for approximately eight hours; the installed-base figure is not established.
What happened
On 9 February 2026 security researcher Adnan Khan disclosed a vulnerability chain, named Clinejection, in the Cline repository. The repository had introduced an AI issue-triage bot in December 2025 whose configuration embedded the issue title verbatim into the prompt sent to the model. By crafting a malicious issue title an attacker manipulated the agent into executing code within the triage workflow. The low-privilege triage workflow and the high-privilege publish workflow shared a cache namespace; the attacker stuffed the cache with dummy data so that legitimate entries were evicted under the least-recently-used policy, and the privileged nightly release workflow later restored the poisoned data as if legitimate. That yielded the npm publish token, which was used to publish an unauthorised version of the package on 17 February 2026, embedding a post-install script. It was withdrawn about eight hours later. Cline revoked the token, removed the vulnerable triage workflow and moved publishing to short-lived credentials.
Where control failed
A public, unauthenticated input was placed inside a prompt that drove a workflow with execution rights. Privilege separation existed between the triage and publish workflows but was defeated by a shared cache namespace, which is a trust boundary nobody had modelled as one. And the release pipeline authenticated with a long-lived static token, so a single disclosure was sufficient to publish as the project.
The authority question
Nobody authorised the release. The publishing identity was a token, and the token was reachable through a chain that began with a stranger typing text into a public issue tracker. Authority to publish belonged to whoever could reach the credential.
What could be proven afterward
Unusually good. The researcher published the full chain, the malicious package version and its withdrawal are on the public registry record, and independent security vendors reproduced and documented the analysis.
Control state, before and after
Before the consequence
Issue titles interpolated into an agent prompt with execution rights. Shared cache namespace across privilege boundaries. Long-lived static publish token.
After the consequence
Token revoked, vulnerable triage workflow removed, publishing moved to short-lived credentials.
Sources
- Primary: Adnan Khan, "Clinejection", security research disclosure · https://adnanthekhan.com/posts/clinejection/
- Secondary: The Hacker News, "Cline CLI 2.3.0 Supply Chain Attack Installed OpenClaw on Developer Systems", Feb 2026 · https://thehackernews.com/2026/02/cline-cli-230-supply-chain-attack.html
- Secondary: Snyk, "How Clinejection Turned an AI Bot into a Supply Chain Attack" · https://snyk.io/blog/cline-supply-chain-attack-prompt-injection-github-actions/
Record history
Published 16 August 2026. Load-bearing facts re-verified against the cited sources on 16 August 2026. Corrections and material changes are appended here with their dates. To report an error in this record, write to hello@regulayer.com with the record slug and the source you believe is authoritative.
This record describes what sources establish about a consequence and the control state around it. It separates confirmed fact from source-stated cause and from architectural analysis, and it makes no claim that any control or product would have prevented the outcome. Gap codes identify a failure class, not a remedy.