Observed incident

Compromised Cline publishing token caused unauthorized OpenClaw installation

Reported

What happened

An unauthorized party published Cline CLI 2.3.0 with a postinstall action that globally installed OpenClaw, following compromise of publishing credentials.

Parties and reporting

AI tools and systems: Cline CLI, GitHub Actions, npm, OpenClaw

Outcome

Cline deprecated the release, revoked the token, published a corrected version, and adopted OIDC publishing. Its IDE extensions were unaffected.

Operating lesson

Isolate AI triage from release credentials and verify that every exposed publishing token is actually revoked.

Evidence and limits

OpenClaw itself was legitimate; its installation was unauthorized. Researchers documented a prior Claude-triage prompt-injection and cache-poisoning vulnerability, but the cited sources do not confirm that this was the token-theft path used for the unauthorized release.

Sources