A stolen npm token let an attacker publish a coding-AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition → CLI with a postinstall agent hookA script the harness runs automatically at a fixed point in an agent's loop — before a tool call, after an edit, on session start.Full definition → for about 8 hours. Check for cline 2.3.0 and adopt OIDC provenance attestations on your own packages.
Key takeaways · AI-distilled
The entry point was an issue-triage GitHub Actions workflow using claude-code-action with allowed_non_write_users set to "*" and Bash access, so a crafted issue title could prompt-inject Claude into running arbitrary commands on the runner.
Cline says the triage job ran on the default branch and so shared a cache scope with the nightly release workflow; an attacker could flood the cache past 10 GB to evict entries, then plant poisoned ones matching the release keys to reach publish secrets.
tokenThe chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.Full definition → rotation failed: the wrong npm token was deleted, and npm's org-level token page showed zero active tokens while the exposed one stayed live. Cline now verifies rotation against the credential itself, not a dashboard.
The researcher reported the flaw via GitHub Security Advisory on January 1, 2026, but it was not addressed until he disclosed it publicly on February 9; Cline is now setting up a formal disclosure process with defined SLAs.
Fixes include removing the AI triage workflows, removing Actions cache use from any workflow holding publish credentials, and publishing to npm only via OIDC with no long-lived tokens.
Terms in this piece · Glossary
token — The chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
agent hook — A script the harness runs automatically at a fixed point in an agent's loop — before a tool call, after an edit, on session start.
