AIDEFEND in Action AIA-0089 Incident Published: Oct 1, 2026

Clinejection: Issue Triage Agent to Release-Token Exposure

A public issue title could make Cline's Claude triage workflow run shell commands; the researcher reproduced this first step in a mirror. Its shared Actions cache created a route to nightly-release secrets. Separately, Cline confirmed that a still-active npm token was used by a third party to publish cline@2.3.0 with an OpenClaw postinstall script, but the exact token-theft sequence was not forensically established.

Indirect Prompt InjectionSupply Chain CompromiseSupply Chain DefenseGitHub Security

7 applicable AIDEFEND defenses

Source: Post-mortem: Unauthorized Cline CLI npm publish on February 17, 2026

Author: Saoud Rizwan

Original article: Feb 24, 2026

Threat Analysis

The public issue title was a low-trust input, yet the triage workflow gave the model Bash access in a default-branch runner. The researcher's mirror proved command execution from that title; shared Actions cache then provided a credible route toward nightly publication secrets.

The researcher placed instructions in an issue title to make the triage agent install an attacker-selected package. This entry was tested on a mirror, not proved as the exact live intrusion route.
The mirror's Claude triage workflow followed the title and ran npm install through Bash; its preinstall script executed in the runner.
The researcher described an Actions-cache poisoning route from triage to nightly publish. Cline confirmed this exposure design, but public evidence does not establish every cache action in the later token theft.

The following confirmed release incident is a separate evidence track. Public forensics did not establish that the later publisher acquired the token through the cache route described by the researcher.

Cline confirmed that it revoked the wrong token after disclosure; a third party used the still-active npm token on 17 February to publish unauthorized cline@2.3.0.
The sole unauthorized change was a postinstall command that globally installed legitimate OpenClaw. Cline reported no malicious binary change or user-data exfiltration.

Cline's post-mortem confirms an unauthorized cline@2.3.0 npm release and a failed token-revocation attempt. It does not reconstruct every step by which the third party first acquired the token. The added postinstall installed legitimate OpenClaw; the vendor found no malicious CLI binary or user-data theft.

Applicable AIDEFEND Defenses (7)

AID-H-018.002

Policy-Based Access Control

Very High

At the trusted claude-code-action tool boundary, install a non-bypassable PreToolUse authorization hook before the triage run starts. Derive the issue author and task class from the verified GitHub event, deny Bash and package installation for public-issue triage, and reject the tool call if the hook fails or cannot resolve those facts. The static allowed_tools list should independently omit these capabilities; a prompt or a hook written by the agent is not an authorization boundary.

AID-H-023

Publisher Integrity & Workflow Hardening

Very High

Bind npm trusted publishing to a protected CI workflow through OIDC, revoke existing publish tokens and select the package setting that requires 2FA and disallows tokens. This blocks the stolen-token publication path. Trusted publishing alone does not disable other publishing methods: that npm setting still permits an authorized person to publish with interactive 2FA. CI-only publication therefore also requires an enforced organizational release policy and verification of registry settings and publisher access; provenance proves origin, not benign code.

AID-H-017.002

Least-Privilege Tool Architecture

Very High

Remove Bash, package-install and file-mutation tools from the public-issue triage agent's registry and expose only typed read, label and templated-comment tools. With no shell primitive registered, an instruction in an issue title has nothing to execute on the runner, so the cache route at step 3 never gets a foothold.

AID-E-001.001

Root & Long-Lived Credential Object Eviction

Very High

At the npm issuer, enumerate publication-capable tokens across every maintainer account, identify the incident-scoped token objects rather than trusting the organization dashboard, and revoke those exact objects. Verify the revoked token ID or fingerprint from issuer records and, only if the original secret is safely available, test that its authentication now fails. A dashboard showing zero organization tokens cannot prove that a maintainer's personal token was revoked.

AID-H-022.001

Sandboxed Dependency Installation

High

Never let a workflow that holds publication credentials restore dependencies from the repository-wide Actions cache. Build the release job's dependency layer only from a signed, promoted cache manifest mounted read-only in an ephemeral no-network installer that fails closed on any object missing from or differing from the manifest, so an entry planted by the low-trust triage runner cannot be consumed by the job that can see the npm token.

AID-E-004

Incident Exploit-Path Closure Verification

High

After the triage workflow, shared cache and publication credentials are remediated, have an independent verifier read back the effective workflow and issuer state: no Bash-capable public-issue triage, no untrusted cache restore in the release job, and every incident-scoped npm token ID revoked. If an old token secret is safely available, perform a negative authentication test; otherwise verify revocation from issuer records without claiming a live probe. Replay the issue-title exploit in an isolated mirror to confirm the tool boundary is closed.

AID-E-003.003

Confirmed Malicious Code & Persistence Eviction

Medium

For the publisher, deprecate the unauthorized cline@2.3.0 at the registry and deny that version in internal mirrors; for consuming organizations, inventory hosts and CI images for cline 2.3.0 by exact version, replace it with 2.4.0 or later, and remove the globally installed OpenClaw where it was not intended. Keep this to unauthorized-release cleanup: the vendor found no malicious binary and no data theft.

What Defenders Should Do Now

For Cline CLI installations, check whether version 2.3.0 was installed, move to a clean 2.4.0-or-later release, and remove OpenClaw if its global installation was unintended.
Keep public-issue triage agents read-only: remove Bash, package installation and file mutation, and separate their cache scope from any workflow that can see publication secrets.
Use CI-only OIDC trusted publishing; identify and revoke every incident-scoped npm token at its issuer. Verify the exact token ID or fingerprint, and test the old secret only if it is safely available.

1 additional consideration

Evidence and deployment boundary

The exact live token-theft route was not established. Cache poisoning is a source-backed risk path, not a proven complete reconstruction of the February 17 incident.

Recommendation: For Cline CLI installations, check whether version 2.3.0 was installed, move to a clean 2.4.0-or-later release, and remove OpenClaw if its global installation was unintended.

Conclusion

AIDEFEND points to two enforceable boundaries here: deny shell capabilities in public-issue triage, and let only an approved CI publisher release packages. Exact token revocation and cache isolation close the remaining incident path without assuming the model will ignore a hostile title.

Last updated: Oct 1, 2026