Back Cybersecuritynews

AI Dev Tool Cline’s npm Token Hijacked by Hackers for 8 Hours

Cybersecuritynews •Guru Baran • February 19, 2026

A compromised publish token gave attackers brief but concerning access to the Cline CLI npm package, exposing developers who installed it during an 8-hour window on February 17, 2026. The incident highlights the growing risk of supply chain attacks targeting developer tooling ecosystems. On February 17 at 3:26 AM PT, an unauthorized party leveraged a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cline CLI npm Package Compromised, Installs OpenClaw on Developer Machines The Cline CLI npm package was compromised on February 17, 2026, allowing an unauthorized party to publish a malicious update (version 2.3.0) that secretly installs OpenClaw on users' machines. This incident affected developers who downloaded the package, with over 4,000 downloads before the malicious version was removed. The attack exploited a compromised publish token, granting access for approximately 8 hours. 8 sources 25

Extracted Entities

AI Dev Tool Cline’s npm Token Hijacked by Hackers for 8 Hours

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)

Tools (1)