mbgsec — Cline issue-triage prompt injection led to npm supply-chain publication

• Category: Security

AI relevance: Cline’s automated, Claude-powered issue triage is a textbook agent toolchain; prompt injection in that workflow directly enabled credential theft and a malicious npm publish.

  • mbgsec reports a prompt-injection attack against Cline’s GitHub issue triage workflow that used a crafted issue title to coerce an LLM agent into running attacker-supplied commands inside CI.
  • The injected payload instructed the agent to install a GitHub-hosted package, which executed in the CI environment and enabled npm token exfiltration.
  • With publishing credentials in hand, the attacker released an unauthorized npm package for Cline, which installed OpenClaw as an additional dependency.
  • The incident reportedly began with a public proof-of-concept ("Clinejection") and exploited the lack of isolation between untrusted issue content and privileged automation.
  • Cline maintainers published a GitHub Security Advisory, deprecated the compromised package, and removed the vulnerable workflow.
  • The report highlights how agentic automation in CI/CD turns prompt injection into a supply‑chain threat, not just a data‑leak risk.

Why it matters

  • Agent workflows that consume untrusted text (issues, PRs, tickets) can become privileged execution paths if prompt boundaries are not enforced.
  • Once CI/CD secrets are exposed, attackers can weaponize downstream package registries, impacting every user who installs the tool.
  • This incident ties prompt injection directly to supply‑chain compromise in the AI tooling ecosystem.

What to do

  • Isolate LLM agents from privileged runners: run triage agents in low‑privilege sandboxes with no access to publish tokens.
  • Strip or escape untrusted inputs: do not inject raw issue titles/body into prompts that can trigger tool execution.
  • Rotate and scope tokens: use short‑lived, least‑privilege npm/GitHub tokens and disable publish access for automation by default.
  • Monitor for automated publishes: alert on unexpected package publishes and enforce human approval gates for releases.

Links