Developers and CI agentic AI attack — Feb 2026

On February 17, 2026, a malicious version of the popular autonomous coding agent CLI, cline, was published to the npm registry. The compromised version, 2.3.0, was downloaded approximately 4,000 times before maintainers deprecated it roughly eight hours later.

What happened

The incident involved the unauthorized publication of cline version 2.3.0, which deviated from the project's established security practices. Unlike legitimate releases, which utilize GitHub Actions with OIDC-based Trusted Publishing and include npm provenance attestations, version 2.3.0 was published manually by a user account and lacked verifiable provenance.

StepSecurity reported that the malicious package contained a post-install script designed to silently install the OpenClaw agent framework globally on the victim's machine. OpenClaw is an AI agent framework that operates with high-level system permissions, including terminal and full disk access. Once installed, it sets up a persistent Gateway daemon—via launchd on macOS or systemd on Linux—that functions as a background WebSocket server.

This payload provides an attacker with a persistent foothold, enabling arbitrary command execution and access to sensitive data, including environment variables, SSH keys, and credentials stored in local configuration files. The threat is particularly severe for CI/CD environments, where the installation of the compromised package could expose cloud provider secrets and GitHub tokens. Furthermore, the persistence mechanism ensures the backdoor remains active even after the original cline package is removed. The incident was independently discovered by Adnan Khan and subsequently documented in a GitHub Security Advisory.