Which versions of cline are malicious?

The following npm versions of cline are flagged malicious: 2.3.0. Treat any of these as compromised.

How do I remediate cline if I installed it?

cline is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed cline — how do I know if it already compromised me?

If cline was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is cline part of a known attack campaign?

Yes — cline is associated with the GHSA-9ppg-jx86-fqw7 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find cline across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for cline (version 2.3.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging cline across your stack and pipelines.

Malicious package

clinenpm

cline is a confirmed malicious npm package (MAL-2026-1380) that steals credentials and exfiltrates sensitive data (malicious version 2.3.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in cline (npm)

MAL-2026-1380

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall cline

What this malware does

The package cline was found to contain malicious code.

Description

On February 17, 2026 at 3:26 AM PT, an unauthorized party used a compromised npm publish token to publish an update to Cline CLI on the NPM registry: [email protected]. The published package contains a modified package.json with an added postinstall script: "postinstall": "npm install -g openclaw@latest" This causes openclaw (an unrelated, non-malicious open source package) to be globally installed when [email protected] is installed. No other files were modified -- the CLI binary (dist/cli.mjs) and all other package contents are identical to the legitimate [email protected] release. A corrected version (2.4.0) was published at 11:23 AM PT and 2.3.0 was deprecated at 11:30 AM PT. The compromised token has been revoked and npm publishing now uses OIDC provenance via GitHub Actions.

Impact

Users who installed Cline CLI [email protected] during the approximately 8-hour window between 3:26 AM PT and 11:30 AM PT on February 17 will have openclaw globally installed. The openclaw package is a legitimate open source project and is not malicious, but its installation was not authorized or intended.

The Cline VS Code extension and JetBrains plugin were not affected. This advisory applies only to the Cline CLI package published on npm.

Patches

Versions 2.4.0 and higher are fixed

Workarounds

If you installed Cline CLI [email protected]:

Update to the latest version of the Cline CLI cline update or npm installl -g cline@latest
Verify that you have a fixed version (2.4.0 or higher) cline --version
Review your environment for any unexpected installation of OpenClaw and remove it if not intended npm uninstall -g openclaw

An unauthorized party used a compromised npm publish token to publish v2.3.0 of the Cline CLI on the NPM. The compromise added a postinstall script that globally installed openclaw.

Malicious versions

1 flagged

2.3.0

Indicators of compromise (SHA-256)

ba9952611b2aa348b1b5cc0349d7b905e32d34effa53081994388c37d0d3462a

38d7531f4d4af07fee607e1d2985d0ea5b41dbf28cca5bc16c8457934e372f86

3c16746b2d863d4c24bbc2297611c642a02942b47d12b675c4a3120911c72eec

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for cline (version 2.3.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging cline across your stack and pipelines.
If you installed it — respond
cline is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If cline was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks cline before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. cline on npm has been identified as a malicious package (version 2.3.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

GHSA-9ppg-jx86-fqw7

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks cline-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database