F5 Labs: Cline CLI 2.3.0 npm token compromise used postinstall to install OpenClaw on developer systems
F5 Labs reports a supply-chain compromise of Cline CLI 2.3.0 via a stolen npm token, installing OpenClaw and highlighting GitHub Actions cache-poisoning and prompt-injection risks.
Supply ChainCI/CD SecurityAI Security
25 Feb 2026
