Notifications
Clear all
Topic starter
19/08/2026 3:52 pm
TL;DR: A malicious post-install script in [email protected] silently installed openclaw, creating a persistence and secrets-access risk for developer and CI/CD environments, according to StepSecurity. The incident shows that provenance, release-path verification, and runtime monitoring now matter as much as dependency hygiene when AI coding agents sit inside build workflows.
NHIMG editorial — based on content published by StepSecurity: Cline Supply Chain Attack Detected, [email protected] silently installs OpenClaw
By the numbers:
- The affected [email protected] version was downloaded approximately 4,000 times before deprecation.
- StepSecurity says most supply chain attacks are detected within the first 24 hours of a malicious package release.
Questions worth separating out
Q: What breaks when malicious npm packages execute during CI/CD installs?
A: The main failure is that package installation becomes code execution inside a trusted build context.
Q: Why do AI coding agents increase supply-chain risk?
A: AI coding agents can choose tooling, install packages, and edit lock files in ways that may bypass the controls humans expect in a managed environment.
Q: How do security teams know if provenance controls are actually working?
A: Look for two signals: packages are rejected when provenance is absent or mismatched, and release workflows only succeed from approved source commits and runners.
Practitioner guidance
- Enforce provenance-backed package acceptance Require OIDC-based trusted publishing and reject npm releases that lack provenance attestations or appear outside the authorised release pipeline.
- Block install-time execution by default Restrict or audit post-install scripts for packages used in developer workstations and CI runners, especially where the package can launch daemons or fetch secondary payloads.
- Scan developer fleets for unexpected AI agent installs Use endpoint and package inventory to search for [email protected] and similar agent packages across devices, then remove unexpected installs and rescan for persistence artefacts.
What's in the full analysis
StepSecurity's full blog post covers the operational detail this post intentionally leaves for the source:
- Exact package artefact indicators, including the malicious post-install script and release-path anomalies that exposed the compromise.
- Step-by-step remediation guidance for affected developers and CI runners, including how to locate and remove openclaw installs.
- Enterprise monitoring details for artifact provenance, package cooldown policy, and Dev Machine Guard workflows.
- Harden-Runner and Threat Center examples that show how the incident was detected in practice.
👉 Read StepSecurity's analysis of the cline supply chain attack and OpenClaw install →
Cline supply chain attack: what it means for CI/CD and AI agents?
Explore further
19/08/2026 4:29 pm
Release provenance is now an access control problem, not just a software integrity issue. When a package can execute code at install time, the release path itself becomes part of the trust boundary. The shift from OIDC-backed publishing to a manual account publish is the kind of control break that should be treated as identity abuse in the software supply chain. Practitioners should model package release permissions as privileged access and govern them accordingly.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a behaviour gap that package compromises can exploit.
A question worth separating out:
Q: Who is accountable when a CI/CD token is used to publish poisoned packages?
A: The accountable teams are the owners of the build and package-publish identities, because those identities controlled the action path. Governance should assign ownership for token scope, rotation, revocation, and monitoring, and it should treat publish rights as privileged access with clear lifecycle control.
👉 Read our full editorial: Cline supply chain attack exposed the risk in AI coding agents
