A GITHUB ISSUE TITLE COMPROMISED 4,000 DEVELOPER MACHINES

Summary from the TLDR newsletter

A version of Cline published to npm on February 17 was byte-identical to the previous version. However, it had a one-line change that installed OpenClaw onto users' machines. This resulted in approximately 4,000 OpenClaw downloads before the package was pulled. The attacker got the npm token by injecting a prompt into a GitHub issue title, which an AI triage bot read, interpreted as an instruction, and executed.