--- title: How “Clinejection” Turned an AI Bot into a Supply Chain... description: A detailed technical breakdown of the 'Clinejection' supply chain attack against the Cline AI coding tool. An attacker exploited an AI-powered GitHub issue... canonical: https://daily.dev/posts/how-clinejection-turned-an-ai-bot-into-a-supply-chain-attack-jkyi3izxq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How “Clinejection” Turned an AI Bot into a Supply Chain Attack | daily.dev og:description: A detailed technical breakdown of the 'Clinejection' supply chain attack against the Cline AI coding tool. An attacker exploited an AI-powered GitHub issue... og:url: https://daily.dev/posts/how-clinejection-turned-an-ai-bot-into-a-supply-chain-attack-jkyi3izxq og:image: https://api.daily.dev/og/posts/jkyi3IzXq.png og:image:alt: How “Clinejection” Turned an AI Bot into a Supply Chain Attack og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How “Clinejection” Turned an AI Bot into a Supply Chain Attack **[Snyk](https://daily.dev/sources/snyk)** · 12 min read · 1 upvotes · 0 comments ## Summary A detailed technical breakdown of the 'Clinejection' supply chain attack against the Cline AI coding tool. An attacker exploited an AI-powered GitHub issue triage bot by crafting a malicious issue title containing a prompt injection payload. This tricked Claude into running npm install from an attacker-controlled commit, executing a preinstall script that deployed the Cacheract tool to poison the shared GitHub Actions cache. The poisoned cache was later consumed by the nightly release workflow, which had access to production npm, VS Code Marketplace, and OpenVSX tokens. Due to incomplete credential rotation after the original disclosure, an unknown actor used a still-active npm token to publish an unauthorized cline@2.3.0 package that installed the OpenClaw AI agent on developer machines. The package was live for ~8 hours before being deprecated. The article covers the full attack chain, timeline, actual vs. potential impact, and concrete defensive recommendations including minimizing AI agent tool permissions, avoiding cache use in release workflows, isolating credentials, sanitizing untrusted input, and migrating to OIDC-based short-lived tokens. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [A GitHub Issue Title Compromised 4,000 Developer Machines](https://daily.dev/posts/a-github-issue-title-compromised-4-000-developer-machines-e5lzhfwln) · Hacker News · 1 upvotes · 0 comments - [Cline CLI npm Package Compromised via Suspected Cache Poison...](https://daily.dev/posts/cline-cli-npm-package-compromised-via-suspected-cache-poison--tjo4h7drs) · Socket · 2 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#cicd](https://daily.dev/tags/cicd), [#github-actions](https://daily.dev/tags/github-actions), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/how-clinejection-turned-an-ai-bot-into-a-supply-chain-attack-jkyi3izxq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How “Clinejection” Turned an AI Bot into a Supply Chain Attack","url":"https://daily.dev/posts/how-clinejection-turned-an-ai-bot-into-a-supply-chain-attack-jkyi3izxq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-clinejection-turned-an-ai-bot-into-a-supply-chain-attack-jkyi3izxq"},"datePublished":"2026-02-19T19:04:50.698Z","dateModified":"2026-03-15T06:38:38.139Z","description":"A detailed technical breakdown of the 'Clinejection' supply chain attack against the Cline AI coding tool. An attacker exploited an AI-powered GitHub issue...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6ffdc08e924eaba083876a1e5d7b89fd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6ffdc08e924eaba083876a1e5d7b89fd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Snyk","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Snyk","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/8fb2a7b471c04bac9af29fbeb3ed1cf6","url":"https://daily.dev/sources/snyk"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-clinejection-turned-an-ai-bot-into-a-supply-chain-attack-jkyi3izxq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,cicd,github-actions,prompt-injection,security","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Snyk","item":"https://daily.dev/sources/snyk"},{"@type":"ListItem","position":3,"name":"How “Clinejection” Turned an AI Bot into a Supply Chain Attack"}]} ```