AI Coding Tool Cline Hit by 4-Step Supply Chain Attack via GitHub Issue Title

·3 views

In December 2025, Cline, an AI coding assistant with over five million users, suffered a supply chain attack stemming from a misconfigured GitHub automation workflow. The workflow granted broad tool permissions — including shell command execution — to an AI agent, and its trigger was open to any GitHub user, not just verified contributors. An attacker exploited this by injecting a malicious instruction through an unsanitized issue title, ultimately flooding the CI cache and stealing three publish tokens. The compromised tokens were used to push a tainted version of the package, cline@2.3.0, which silently installed a second AI agent on users' machines via a postinstall script. The malicious package circulated for roughly eight hours and was installed approximately 4,000 times before being detected, with the exploit arriving eight days after public disclosure of the underlying vulnerability.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Robust-GAP Framework Claims to Eliminate Hallucinations in Multi-Document AI Summarization

Researchers have published Robust-GAP, a hierarchical Retrieval-Augmented Generation framework aimed at preventing semantic hallucinations and knowledge drift when AI models summarize multi-document log data. The framework combines three core components — dynamic causal graph extraction, schema-guided topology verification, and metadata provenance propagation — to ensure that large language models do not fabricate false causal links between unrelated events. Standard RAG pipelines struggle with this problem because they lack mechanisms to track causality across unstructured event streams, sometimes incorrectly linking coincidental log entries. Robust-GAP is described as the fourth generation of a research lineage dating back to a 2016 array-reduction algorithm, with intermediate iterations in 2024 and 2026 progressively adding document hierarchy and graph-anchoring capabilities. The full academic preprint has been made openly available on Zenodo under DOI 10.5281/zenodo.21436390.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Edge Computing Middleware Tackles Security and Scale in Distributed Systems

The rapid growth of IoT devices, 5G networks, and real-time data processing is driving a major shift toward edge computing, which moves computation closer to data sources. This distributed model reduces latency and bandwidth use but introduces significant complexity, especially for middleware that must manage diverse, resource-constrained environments. Edge middleware now goes beyond simple message passing, handling device management, local workload orchestration, connectivity, and security enforcement across fragmented networks. Security is a core challenge, as each edge device represents a potential attack vector, requiring solutions like PKI-based authentication, mutual TLS, end-to-end encryption, and fine-grained access controls. Middleware plays a central role in implementing these protections while keeping distributed edge architectures scalable and resilient.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Code Reviews Are More Than a Final Checkbox Before Merging

Code reviews serve purposes well beyond bug detection, including knowledge sharing, mentoring junior engineers, and enforcing architectural consistency. Many teams undermine this value by treating reviews as a formality or focusing on minor style issues rather than design and system-level concerns. Effective reviewers are advised to first assess the overall direction of a change before examining individual lines, and to prioritize comments by impact — from architecture and scalability down to security and, lastly, formatting. Constructive, question-based feedback is recommended over directive criticism to foster psychological safety and collaborative discussion. Keeping pull requests small and focused is also highlighted as critical to ensuring thorough, timely reviews.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Human-in-the-Loop Agents Help AI Bots Know When to Ask for Help

A developer building a customer support bot with LangGraph and MCP discovered that the bot was confidently delivering incorrect answers because it lacked any mechanism to flag uncertainty. This prompted an exploration of human-in-the-loop agents, which are designed to pause execution and seek human approval when confidence falls below a set threshold. In LangGraph, this can be implemented using the add_conditional_edges method to route uncertain states toward a human review step before a response is sent. The approach requires careful synchronization to ensure the bot does not resume execution before human approval is received. Adding this oversight layer can meaningfully improve the reliability and trustworthiness of automated support systems.

0 comments Read more at DEV Community