Cline CLI 2.3.0 was published with a stolen npm token, installing OpenClaw in an 8-hour attack affecting ~4,000 downloads.
The malicious version of Cline's npm package — 2.3.0 — was downloaded more than 4,000 times before it was removed.
Self-hosted agents execute code with durable credentials and process untrusted input. This creates dual supply chain risk, ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results