Supply Chain Attack targeting Cline installs OpenClaw | Endor Labs

What it is

cline@2.3.0 on npm (tracked as GHSA-9ppg-jx86-fqw7, first reported by Adnan Khan) was published with a stolen or leaked long-lived token for the clinebotorg npm account. It was not published through the maintainers' trusted-publishing pipeline. Its post-install hook runs npm install -g openclaw@latest. The page calls it prank-like rather than a serious attack. OpenClaw is benign and the Gateway daemon (launchd/systemd user service) is not installed or started.

How it works

Cline's maintainers had enabled trusted publishing (GitHub Actions OIDC) but did not disable token-based publishing. The page says this is inferred from the metadata, not confirmed. A token alone was therefore enough to publish. Endor Labs' differential analysis compared 2.3.0 with the previous version, 2.2.3-nightly.1771330659, and flagged two changes:

• A post-install hook was added in 2.3.0.
• Provenance disappeared and the publisher changed.

Preconditions / Affected

• You are affected only if you installed cline 2.3.0. The page notes the package had 418,545 monthly downloads (Jan 19 to Feb 17), so many developer machines probably pulled it. That figure covers the whole package, not just this version.
• The page says the version has been flagged, but the tarball and metadata were still available when it was written.

What to do

Check your version, update to 2.4.0, and remove OpenClaw:

cline --version
npm uninstall -g openclaw

The page says credential or secret rotation is not needed.

For maintainers: after configuring trusted publishers, disable traditional token-based publishing. The npm docs "strongly recommend" this.

For consumers: check new versions for attestations before installing, and treat a sudden loss of attestations as a warning sign, as with cline@2.3.0.

Caveats

• The token-compromise explanation is inferred from metadata, not confirmed.
• Checking attestations by hand is practical only for direct dependencies. The page says transitive dependencies need package-manager support, for example refusing versions that lack attestations or have lost them.
• The page's command is written cline –version with an en dash, which is probably a typesetting artifact; use --version.