From Issue Title to Malware: The Five-Step AI Supply Chain Attack

In The Week Prompt Injection Became a Supply Chain Weapon, we covered the Clinejection attack as part of a broader seven-day pattern across the AI stack. That article asked a structural question: have you governed the chain, or only the individual links?

This article answers a different question. How, precisely, does a single GitHub issue title become malware running on 4,000 developer machines? Not in theory. In five documented, reproducible steps.

The Timeline Nobody Acted On

January 1, 2026. A vulnerability report lands on the Cline project. The report describes how an AI triage bot processing GitHub issues can be hijacked through prompt injection embedded in issue metadata. The report is acknowledged. Nothing changes.

Twenty-seven days pass.

January 28. A malicious GitHub issue appears: issue #8904. The title contains a prompt injection payload. No exploit code in the body. No attachment. The attack surface is a text field.

Twelve more days pass.

February 9. Public disclosure. The vulnerability gets attention. A suspicious token is revoked. The wrong token. The one that mattered stayed active.

Eight more days.

February 17. The attacker uses the still-valid credentials to push cline@2.3.0 to the npm registry. The package contains a postinstall hook that silently installs OpenClaw globally on every machine that runs npm install. Eight hours elapse before detection and removal. Approximately 4,000 downloads.

Forty-seven days from vulnerability report to exploitation. Not because the attack was sophisticated. Because the response was slow.

Five Steps, No Exploits Required

The Clinejection attack chain is remarkable for what it does not require. No zero-day exploit. No buffer overflow. No memory corruption. Every step uses legitimate features of legitimate platforms.

Step 1: Natural language as payload. The attacker writes a GitHub issue. The title contains instructions that look like natural language to a human reviewer but function as directives to an AI agent. This is prompt injection in its purest form: adversarial input indistinguishable from normal input.

Step 2: The triage bot becomes the attacker. An AI-powered bot reads the issue to categorize and prioritize it. The injected instructions hijack the bot’s execution context. The bot is now operating under attacker control. In security terminology, this is a confused deputy: a privileged process tricked into using its own authority against the system it serves.

Step 3: Cache poisoning for persistence. The hijacked bot has access to the CI/CD environment. It poisons the build cache. This is the step that transforms a one-time injection into a persistent foothold. Subsequent builds inherit the compromised cache without any further interaction from the attacker.

Step 4: Credential extraction. On the next build cycle, the poisoned cache executes code that extracts three credentials from the environment: NPM_RELEASE_TOKEN, VSCE_PAT, and OVSX_PAT. These are publish tokens for npm, the VS Code Extension Marketplace, and Open VSX, respectively. The CI/CD environment exposed these credentials to processes with no legitimate need for them.

Step 5: Malicious publish. Using the stolen npm token, the attacker pushes a compromised version of the Cline CLI package. The package’s postinstall script installs OpenClaw, bootstrapping a second AI agent on every developer machine that installs the update. One AI tool silently deploying another AI tool.

That last detail deserves a pause. The attack endpoint is not data theft or ransomware. It is the installation of a second AI agent. The attacker used one AI system to compromise another, which then installs a third on victim machines. This is AI supply chain recursion.

What Cloudflare’s Data Adds

The Clinejection attack happened in a specific environment. Cloudflare’s 2026 threat report, published two weeks earlier, describes the broader environment that makes attacks like it inevitable.

Three numbers from that report matter here.

63% of all logins use previously compromised credentials. Not weak passwords. Not brute force. Credentials that were stolen in prior breaches, circulated on dark web markets, and reused by the original account holders. When the Clinejection attacker extracted NPM_RELEASE_TOKEN, that token entered this same recycling system. Stolen credentials have market value precisely because they work.

94% of login attempts originate from bots. The internet’s authentication layer is already mostly machine-to-machine. Human logins are the exception, not the rule. Clinejection fits this pattern exactly: the “login” to the npm registry that published the malicious package was an automated process using a stolen token. No human was involved at any point in the publish flow.

46% of analyzed emails fail DMARC authentication. Nearly half of email traffic cannot prove it came from who it claims to be. This statistic seems unrelated to Clinejection, but it illustrates the same underlying problem: the internet’s trust infrastructure was designed for a world where identity verification was a human process. That world no longer exists.

Cloudflare’s report contains a sentence that captures the convergence: “When threats move at machine speed, human-centric defense is no longer a viable shield.” Clinejection is the case study that proves the assertion. Every step in the attack chain moved faster than human review could catch it. The vulnerability sat unpatched for 27 days. The malicious package was live for 8 hours. Between those two timestamps, every action was automated.

The Confused Deputy at Scale

The confused deputy problem has existed in computer security since 1988 when Norm Hardy first described it. A program with legitimate authority is tricked into misusing that authority on behalf of an unauthorized party.

Clinejection is the confused deputy problem adapted for the AI era. The triage bot had legitimate access to the CI/CD environment. It needed that access to do its job. The prompt injection did not give it new permissions. It redirected existing permissions toward an unauthorized purpose.

This is why perimeter security and access control lists cannot solve the problem alone. The bot was inside the perimeter. It had the right credentials. Every action it took was technically authorized. The failure was not in authentication or authorization. It was in intent verification. Nobody checked whether the bot’s actions aligned with its purpose.

As we explored in Your AI Stack Has a GitHub Actions Problem, CI/CD pipelines have become one of the most dangerous surfaces in modern software development. Clinejection did not exploit a flaw in GitHub Actions specifically, but it exploited the same architectural assumption: that processes running inside the build environment are trustworthy because they passed the front door.

The Deeper Pattern

Cloudflare’s report documents nation-state actors weaponizing legitimate cloud tools. Google Calendar for command-and-control. Dropbox for data exfiltration. GitHub for payload hosting. Azure for lateral movement.

Clinejection follows the same pattern at a different layer. The attack weaponized GitHub Issues (a legitimate collaboration tool), an AI triage bot (a legitimate productivity tool), npm (a legitimate package registry), and a CI/CD pipeline (a legitimate build system). No malicious infrastructure was required. The attacker used the victim’s own tools as the attack platform.

This is what makes AI supply chain attacks qualitatively different from traditional supply chain attacks. In a traditional attack, the adversary must either compromise a package directly or compromise the maintainer’s credentials. In an AI-mediated attack, the adversary compromises an AI agent that has access to the package and the credentials. The agent becomes an unwitting intermediary.

In Your AI Provider Is a Supply Chain Risk, we examined how model providers themselves represent a supply chain surface. Clinejection demonstrates the complementary risk: your own AI agents, the ones you deploy and control, can be turned into supply chain attack vectors by anyone who can write a convincing sentence in a text field.

What Governance Would Have Caught

Walk backward through the five steps and ask where governance controls would have interrupted the chain.

At Step 4, credential scoping would have prevented the extraction. The build process does not need publish tokens during triage. Principle of least privilege, applied to the CI/CD environment, removes the tokens from the attacker’s reach entirely.

At Step 3, cache integrity verification would have detected the poisoning. Signed caches, content-addressed storage, or simple checksums on cache contents would flag unexpected modifications.

At Step 2, output validation on the triage bot would have caught the anomalous behavior. A bot whose job is to label and categorize issues should not be executing arbitrary code. Constraining the bot’s action space to its actual function (read issue, apply label, post comment) removes the execution capability the attacker relied on.

At Step 1, input sanitization of issue metadata before AI processing would have stripped or flagged the injection payload. This is the same input validation discipline that the security community has practiced for SQL injection since the 1990s. Applied to a new medium.

None of these controls require novel technology. Credential scoping, cache signing, output validation, input sanitization. These are established security practices. The Clinejection attack succeeded because they were not applied to the AI-mediated portions of the development pipeline.

The 47-day window between vulnerability report and exploitation is the most damning detail. The attack was reported. The response was to revoke the wrong token. Governance is not just controls. It is the operational discipline to respond correctly when controls identify a threat.

The Machine-Speed Problem

Human security teams review alerts during business hours. They triage by severity. They investigate. They escalate. They remediate. This process takes hours at best, days at worst.

Clinejection’s active exploitation window was eight hours. The malicious package was published, downloaded 4,000 times, and removed in less than a single business day. A human-speed response caught it, eventually. But 4,000 developer machines were already compromised.

Cloudflare’s data makes the math explicit. When 94% of login attempts are automated and 63% use stolen credentials, the threat is already operating at machine speed. Clinejection added a new dimension: the attack was not just machine-speed at the network layer. It was machine-speed from initial injection through credential theft through malicious publish through victim installation. End to end, no human in the loop.

Defending against machine-speed attacks with human-speed processes is a losing strategy. Not because humans are incompetent. Because the response time asymmetry is structural. The attacker automates. The defender deliberates. The attacker wins the race every time.

What This Changes

Before Clinejection, AI supply chain attacks were a theoretical category. Security researchers described them. Conference talks warned about them. Risk assessments included them as future possibilities.

After Clinejection, the category has a proof of concept with a body count. 4,000 compromised developer machines, three stolen credential types, and an AI agent silently bootstrapped on victim systems. Five steps from a GitHub issue title to malware.

The attack was not sophisticated. That is the point. It required no zero-days, no advanced persistent threat infrastructure, no nation-state resources. It required a text input field, an AI bot with excessive permissions, and credentials stored where they should not have been.

Every organization running AI agents in their development pipeline should ask three questions today. Does any AI agent in our build process have access to publish credentials? Can any AI agent execute arbitrary code based on untrusted input? Would we detect cache poisoning in our CI/CD environment?

If the answer to any of these is yes, unknown, or “we haven’t checked,” the Clinejection attack chain is available for reuse. The technique is documented. The playbook is public. The next attacker does not need to invent anything. They just need to find a target that has not yet applied the lessons.

This analysis synthesizes the Clinejection attack investigation (grith.ai, March 2026) and Cloudflare’s 2026 threat landscape report (March 2026), building on our earlier coverage in The Week Prompt Injection Became a Supply Chain Weapon (February 2026).

Victorino Group helps organizations govern AI agents before they become supply chain attack vectors. Let’s talk.