Hijacked AI triage bot leads to poisoned npm release
Cline's GitHub workflow used an AI agent to triage issues, and a prompt hidden in an issue title could hijack it and expose release credentials. On Feb 17 an unknown actor used a leftover token to publish a tampered release of the popular coding tool that silently installed another AI agent on users' machines; it was pulled about eight hours later.
Damage
malicious package live ~8 hours; install count not disclosed; payload installed OpenClaw rather than overtly destructive malware
Sources
Adnan Khan, second source. The vulnerable workflow was added 21 Dec 2025. Whether the publisher used the original prompt-injection path or a copied proof of concept is unclear. The token had been missed in Cline's 9 Feb credential rotation.
Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.
