SUPPLY CHAIN ATTACK SECRETLY INSTALLS OPENCLAW FOR CLINE USERS

Summary from the TLDR InfoSec newsletter

A prompt-injection flaw in Cline allowed an attacker to steal an npm publish token and ship a version that silently installed OpenClaw on users' systems for about eight hours.