{
 "id": "AIR-2026-0407",
 "slug": "actor-exploited-cline-ai-workflow-and-published-unauthorized",
 "title": "Actor Exploited Cline AI Workflow and Published Unauthorized CLI Package",
 "summary": "An unknown actor exploited prompt injection in an AI workflow to obtain credentials and publish an unauthorized npm package. The developer deprecated the release and revoked credentials without user data exposure.",
 "type": "attack_on_ai",
 "categories": [
  "prompt_injection",
  "supply_chain"
 ],
 "severity": 3,
 "targets": [
  "Anthropic",
  "framework_or_tooling"
 ],
 "products": [
  "Cline",
  "Claude"
 ],
 "incident_date": "2026-02-17",
 "incident_date_precision": "day",
 "first_reported": "2026-02-17",
 "sources": [
  {
   "url": "https://incidentdatabase.ai/cite/1680",
   "publisher": "AI Incident Database",
   "title": "Unknown Actor Reportedly Exploited Cline's Claude-Powered GitHub Issue-Triage Workflow and Published an Unauthorized Cline CLI Package",
   "published_at": "2026-02-17"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_aiid",
 "tags": [
  "prompt_injection",
  "supply_chain",
  "npm"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:59:35.797Z"
}