Clinejection — CI/CD pipeline compromise via Cline's issue triage bot, 4,000 machines infected
Date: 2026-02
Affected: Cline AI coding agent — 4,000 developer machines; npm ecosystem
Attack vector: prompt-injection
Category: real-world
Severity: Critical

A prompt injection in Cline's Claude-powered GitHub issue triage bot allowed code execution in CI, poisoning of GitHub Actions cache, and theft of npm publish tokens. Attacker published malicious Cline CLI v2.3.0 to npm, silently installing malware on ~4,000 developer machines during an 8-hour window.

Impact: Supply chain compromise; mass developer infection; CI/CD pipeline weaponization

Mitigations:
Isolate AI triage bots from CI/CD execution
Package integrity monitoring
npm publish token protection (2FA, short-lived)

Architectural layers (MAESTRO):
label: Agent Ecosystem
notes: Prompt injection via GitHub issue → CI/CD compromise
role: origin
label: Deployment & Infrastructure
notes: 4,000 developer machines infected via poisoned npm package
role: impact