# Cline Supply Chain Attack Detected: cline@2.3.0 Silently Installs OpenClaw

Malicious cline@2.3.0 npm release added a postinstall script installing OpenClaw, giving attackers a persistent daemon with credential access and command execution on ~4,000 machines.

- Payout: Real-world hack
- Severity: critical
- Program: Cline
- Analysis by: StepSecurity
- Disclosed: 2026-04-09
- Write-up quality: 7/10
- Original: https://www.stepsecurity.io/blog/cline-supply-chain-attack-detected-cline-2-3-0-silently-installs-openclaw
- Library page: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-cline-supply-chain-attack-detected-cline-2-3-0-silently-installs-openclaw
- Tags: area:oss domain:oss impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:ci-cd tech:nodejs technique:recon technique:source-review vuln:misconfiguration

**Target:** npm package cline CLI (postinstall script)
**Root cause:** Attacker published cline@2.3.0 manually via the clinebotorg npm account instead of the OIDC trusted-publishing pipeline, adding a postinstall script `npm install -g openclaw@latest` that installs a persistent agent daemon without consent.
**Steps:**
1. Observe cline@2.3.0 published by `_npmUser` clinebotorg (engineering@cline.bot) instead of GitHub Actions OIDC trusted publisher
2. Note absence of npm provenance attestations on 2.3.0
3. Inspect package.json: `"postinstall": "npm install -g openclaw@latest"`
4. Run `npm install cline` to trigger global install of openclaw, which registers a launchd/systemd daemon serving ws://127.0.0.1:18789
5. Daemon reads ~/.openclaw/credentials/ and config.json5, exposing API keys/OAuth tokens and shell execution via operator API
**How found:** StepSecurity's npm monitoring flagged two anomalies: publish identity deviated from the project's OIDC trusted-publishing pattern to a manual user account, and provenance attestations were missing; package contents then revealed the postinstall script.
**Exploitation:** Anyone running npm install cline during the ~8h window got openclaw installed globally as a persistent daemon with terminal and full disk access; the gateway's operator API allows arbitrary shell commands, and CVE-2026-25253 (role:"operator" with omitted scopes) grants full operator access via a crafted WebSocket handshake. CI runners exposed cloud credentials and GitHub tokens.
**Escalation:** Chained to CVE-2026-25253 for unauthenticated operator takeover of the local gateway; persistence via launchd/systemd survives package removal and reboots.
**Insight:** Diff the `_npmUser`/trustedPublisher block and provenance attestations against a package's release history — a sudden switch from OIDC CI publishing to a human account plus missing provenance is a high-signal compromise indicator before reading any code.