Observed Signal · May 16, 2026 · Security Incident · Source: DEV Community · Impact: 3/5 · Sentiment: Negative
Clinejection: AI Triage Bot Enables NPM Supply-Chain Attack
Clinejection is a chained supply‑chain exploit that turned an AI‑powered issue‑triage workflow into an attack vector, resulting in an unauthorized npm publication of a malicious package. The attack combined indirect prompt injection (via a crafted GitHub issue title), GitHub Actions cache poisoning, token exfiltration, and an npm publish that added a postinstall script to install a rogue AI agent called OpenClaw. Approximately 4,000 installs occurred during an eight‑hour window before the malicious package (cline@2.3.0) was yanked. The incident highlights gaps in workflows that give LLM agents write access and long‑lived automation tokens, and underscores defenses such as OIDC provenance, lifecycle‑script inspection, and local pre‑install SCA gates.
Significant developer supply‑chain security incident that exposes systemic risks in AI coding assistants (LLM agents with write permissions and long‑lived automation tokens); relevant to any organization using agentic developer tooling but not an industry‑level platform policy change.
Track Anthropic Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- The attack, named "Clinejection," exploited an AI-powered triage workflow that read GitHub issue content and had write permissions via a GitHub Actions token.
- Attack chain combined indirect prompt injection, GitHub Actions cache poisoning, token theft, and unauthorized npm publication of cline@2.3.0.
- A malicious postinstall script in cline@2.3.0 silently installed OpenClaw as a global package; ~4,000 downloads occurred before the package was removed.
- Cline's npm automation token was a long-lived secret not protected by OIDC provenance; the article states npm's OIDC trusted publishing (introduced 2024) would have blocked the publication.
- LucidShark and other tooling authors recommend pre-install lifecycle script inspection, local SCA pre-flight checks, and separating read/write permissions in AI workflows as mitigations.
Connected Companies & Entities
2 Entities mappedOntology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
Axios npm Package Hijacked to Install Backdoor
A malicious supply-chain attack compromised a maintainer account for the widely used Axios npm package, adding a new dependency (plain-crypto-js) whose postinstall script downloaded and executed a remote-access trojan before self-deleting. The article frames this incident as part of a broader acceleration of automated, ecosystem-scale supply-chain attacks enabled by autonomous AI coding agents that install dependencies at machine speed. It describes a related campaign called TeamPCP that began by stealing a Trivy CI token, led to a self-propagating CanisterWorm across 66+ npm packages, and cascaded into Docker Hub, PyPI and the VS Code extension marketplace. Behavioral detection (e.g., Socket) that inspects package actions rather than CVE databases can detect novel malicious packages quickly; Socket detected the suspicious dependency in minutes, while the compromised Axios versions remained live for about three hours before removal. The piece warns that AI agents selecting and installing dependencies autonomously expands the attack surface and compresses the window for human review.
Defending AI Agent Skills From Supply-Chain Attacks
A technical post explains a new supply-chain attack vector targeting AI agent 'skills' (SKILL.md files) which bypass package-manager protections and endpoint detection, allowing malicious instructions to run in high-trust developer environments. The author documents why existing defenses (pnpm/npm safeguards, EDR) fail against skill layers, cites that ClawHub contained 341 malicious skills (11.9%) of 2,857 in Feb 2026, and describes a practical mitigation—'skill-firewall'—that combines static analysis with LLM-based scanning for Claude Code / Cursor skill layers. The article also shares operational and UX lessons from building the tool, such as symlink attack vectors and preferring agent warnings over end-user alerts.
North Korean Hackers Poisoned 140+ npm Packages
Microsoft attributed a supply-chain attack on the Mastra AI ecosystem to Sapphire Sleet (also tracked as BlueNoroff), in which attackers poisoned over 140 npm packages that AI coding assistants and developer tooling actively surface. The incident is notable because LLM-backed IDE assistants (e.g., Copilot, Cursor) can suggest or auto-install dependencies, allowing malicious code to reach developer machines without traditional phishing. Microsoft’s public details are limited: a state-level actor, 140+ contaminated packages, and a focus on AI-assisted development workflows. The article highlights detection gaps—npm audit relies on published CVEs, lockfiles help only post-install, and LLMs do not validate package provenance—and describes Sentinel’s SlopScan integration as a defensive pattern that extracts package names from LLM output and flags or blocks suspicious packages before installation. Publication date: 2026-06-20.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.