Cline package publication incident
Cline · issue-triage agent
- What happened
- Cline disclosed that its AI issue-triage workflow could be steered by a public issue title into running commands, opening a path to its release credentials. An npm publishing token stayed active after an incomplete rotation, and on 17 February a third party used it to publish a Cline CLI version that installed an extra agent package on users’ machines.
- Impact
- The unauthorised version was available for about eight hours (reported). Cline said the added package was legitimate software and its review found no malicious code delivered or user data accessed.
- What would have caught it
- Keep agents that read public input away from shell access and release credentials. Confirm token revocation and alert on releases that do not match an approved build.
- Sources
- Cline post-mortem (source date 2026-02-24)
- Security researcher’s account (source date 2026-02-09)