Malicious Package Affecting cline package, versions =2.3.0
Threat Intelligence
Exploit Maturity
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Attacked
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-CLINE-15967873
- published10 Apr 2026
- disclosed16 Feb 2026
- creditAdnan Khan
Introduced: 16 Feb 2026
Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Avoid using all malicious instances of the cline package.
Overview
cline is a malicious package.
NPM publishing token for this package was compromised and useb by an unauthorized party to publish version 2.3.0 containing a modified package.json with an added postinstall script "postinstall": "npm install -g openclaw@latest". This causes openclaw (an unrelated, non-malicious open source package) to be globally installed.