com.pandadoc.mcp/mcp

Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability

## Summary The `kanban` npm package (used by the `cline` CLI) starts a WebSocket server on `127.0.0.1:3484` with no Origin header validation. Any website a developer visits can silently connect to the kanban server via WebSocket and: 1. Leak sensitive data in real-time: workspace filesystem paths, task titles/descriptions, git branch info, AI agent chat messages 2. Hijack running AI agent terminals by injecting arbitrary prompts into the agent's input, leading to remote code execution 3. Kill

Malicious code in cline (npm)

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (38d7531f4d4af07fee607e1d2985d0ea5b41dbf28cca5bc16c8457934e372f86) The package cline was found to contain malicious code. ## Source: google-open-source-security (ba9952611b2aa348b1b5cc0349d7b905e32d34effa53081994388c37d0d3462a) An unauthorized party used a compromised npm publish token to publish v2.3.0 of the Cline CLI on the NPM. The compromise added a postinstall script that globally installed openclaw.

Unauthorized npm publish of cline@2.3.0 with modified postinstall script

### Description On February 17, 2026 at 3:26 AM PT, an unauthorized party used a compromised npm publish token to publish an update to Cline CLI on the NPM registry: cline@2.3.0. The published package contains a modified package.json with an added postinstall script: `"postinstall": "npm install -g openclaw@latest"` This causes openclaw (an unrelated, non-malicious open source package) to be globally installed when cline@2.3.0 is installed. No other files were modified -- the CLI binary (dist/cl