Which versions of cline are malicious?

The following npm versions of cline are flagged malicious: 2.3.0. Treat any of these as compromised.

How do I remediate cline if I installed it?

Remove cline from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed cline — how do I know if it already compromised me?

If cline was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is cline part of a known attack campaign?

Yes — cline is associated with the GHSA-9ppg-jx86-fqw7 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find cline across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for cline (version 2.3.0).

Malicious package

clinenpm

Advisory published Feb 19, 2026Updated Sep 7, 2026

cline is a confirmed malicious npm package (MAL-2026-1380) that executes malicious code on install (malicious version 2.3.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in cline (npm)

MAL-2026-1380

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall cline

What this malware does

The package cline was found to contain malicious code.

Description

On February 17, 2026 at 3:26 AM PT, an unauthorized party used a compromised npm publish token to publish an update to Cline CLI on the NPM registry: [email protected]. The published package contains a modified package.json with an added postinstall script: "postinstall": "npm install -g openclaw@latest" This causes openclaw (an unrelated, non-malicious open source package) to be globally installed when [email protected] is installed. No other files were modified -- the CLI binary (dist/cli.mjs) and all other package contents are identical to the legitimate [email protected] release. A corrected version (2.4.0) was published at 11:23 AM PT and 2.3.0 was deprecated at 11:30 AM PT. The compromised token has been revoked and npm publishing now uses OIDC provenance via GitHub Actions.

Impact

Users who installed Cline CLI [email protected] during the approximately 8-hour window between 3:26 AM PT and 11:30 AM PT on February 17 will have openclaw globally installed. The openclaw package is a legitimate open source project and is not malicious, but its installation was not authorized or intended.

The Cline VS Code extension and JetBrains plugin were not affected. This advisory applies only to the Cline CLI package published on npm.

Patches

Versions 2.4.0 and higher are fixed

Workarounds

If you installed Cline CLI [email protected]:

Update to the latest version of the Cline CLI cline update or npm installl -g cline@latest
Verify that you have a fixed version (2.4.0 or higher) cline --version
Review your environment for any unexpected installation of OpenClaw and remove it if not intended npm uninstall -g openclaw

An unauthorized party used a compromised npm publish token to publish v2.3.0 of the Cline CLI on the NPM. The compromise added a postinstall script that globally installed openclaw.

Malicious versions

1 flagged

2.3.0

Indicators of compromise (SHA-256)

ba9952611b2aa348b1b5cc0349d7b905e32d34effa53081994388c37d0d3462a

38d7531f4d4af07fee607e1d2985d0ea5b41dbf28cca5bc16c8457934e372f86

3c16746b2d863d4c24bbc2297611c642a02942b47d12b675c4a3120911c72eec

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for cline (version 2.3.0).
If you installed it — respond
Remove cline from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If cline was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. cline on npm has been identified as a malicious package (version 2.3.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

GHSA-9ppg-jx86-fqw7

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks cline-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database