Cline CLI npm Package Compromised, Installs OpenClaw on Developer Machines

The Cline CLI npm package was compromised on February 17, 2026, allowing an unauthorized party to publish a malicious update (version 2.3.0) that secretly installs OpenClaw on users' machines. This incident affected developers who downloaded the package, with over 4,000 downloads before the malicious version was removed. The attack exploited a compromised publish token, granting access for approximately 8 hours.