{"action":"Upgrade cline to 2.4.0 or later.","affected":[{"fixed":"2.4.0","introduced":"2.3.0"}],"component":"cline","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["2.4.0"],"ghsa_id":"GHSA-9ppg-jx86-fqw7","id":"tcs_01M5KFGGTHMDAW3A724SKAYTVT","modified_at":"2026-09-09T05:30:03.599152973Z","published_at":"2026-02-19T15:17:10Z","references":["https://osv.dev/vulnerability/GHSA-9ppg-jx86-fqw7","https://github.com/cline/cline/security/advisories/GHSA-9ppg-jx86-fqw7","https://github.com/advisories/GHSA-9ppg-jx86-fqw7","https://github.com/cline/cline","https://github.com/ossf/malicious-packages/blob/4012598c9b06e58935bd8883f7a0cd37c3130664/osv/malicious/npm/cline/MAL-2026-1380.json"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-9ppg-jx86-fqw7","url":"https://osv.dev/vulnerability/GHSA-9ppg-jx86-fqw7"}],"summary":"Unauthorized npm publish of cline@2.3.0 with modified postinstall script"}