4K unintended installs in very odd supply chain attack Someone compromised open source AI coding assistant Cline CLI's npm package earlier this week in an odd supply chain attack that secretly ...

Cline CLI 2.3.0 was published with a stolen npm token, installing OpenClaw in an 8-hour attack affecting ~4,000 downloads.

A prompt-injection test involving the viral OpenClaw AI agent showed how assistants can be tricked into installing software without approval.

Engineering teams can’t afford to treat AI as a hands-off solution; instead, they must learn how to balance experimentation ...