3 ms·
> Seem that github:cline/cline#b181e0 actually pointed to a forked respository with the malicious postinstall script. This seems to be a much bigger problem he
by raincole 8mo ago
> Seem that github:cline/cline#b181e0 actually pointed to a forked respository with the malicious postinstall script.
This seems to be a much bigger problem here than the fact it's triggered by an AI triage bot.
I have to admit until one second ago I had been assuming if something starts with github:cline/cline it's from the same repo.
- stavros 8mo agoIt was actually glthub/cline, as per the article, not github/cline.
- ssgodderidge 8mo agoThe original report by the developer, Khan, mentions that github:cline/cline would also work[0]. > github:cline/cline#aaaaaaaa could point to a commit in a fork with a replaced package.json containing a malicious preinstall script. [0] https://adnanthekhan.com/posts/clinejection/#the-prompt-injection https://adnanthekhan.com/posts/clinejection/#the-prompt-inje...