excalidrop@0.1.4
Drop an Excalidraw canvas + MCP server into any project — per-project ports, one-command AI agent setup
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is not shown to be malicious at install time, but it exposes broad GitHub and MCP configuration capability with an ineffective repository check. Downgrade for a dangerous, user-invoked capability rather than block as malware.
Static reason
One or more suspicious static signals were detected.
Trigger
Running npx excalidrop init, setup, or its MCP GitHub features.
Impact
A user or connected agent can grant the package a persistent MCP launch path and make GitHub changes using local credentials.
Mechanism
Explicit agent configuration and GitHub API repository mutation.
AI rationale
The package is not shown to be malicious at install time, but it exposes broad GitHub and MCP configuration capability with an ineffective repository check. Downgrade for a dangerous, user-invoked capability rather than block as malware.
Evidence
dist/cli.jsdist/utils/github.jsdist/target.js.excalidrop.jsoncanvas.excalidraw.mcp.json.config/excalidrop/gh_token
Network endpoints1
api.github.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest runs a postinstall script automatically.
- The user-invoked init command writes a project MCP configuration that launches this package through npx.
- GitHub write helpers accept any repository value because the intended repository assertion is empty.
- The package retrieves GitHub credentials from an environment variable or the GitHub CLI for its GitHub-backed canvas features.
Evidence against
- The postinstall script is print-only and directs setup to an explicit command.
- Agent installation is prompted during init rather than performed by the install hook.
- No self-dependency, remote payload loader, credential exfiltration endpoint, or reviewer-directed text was found.
- The flagged frontend secret marker is bundled React internals, not an exposed credential.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Source & flagged code
11 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/frontend/assets/index-DIz4WrSB.jsView file
41patternName = google_api_key
severity = high
line = 41
High
High Secret
Package contains a high-severity secret pattern.
dist/frontend/assets/index-DIz4WrSB.jsView on unpkg · L41Findings
9 High6 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretdist/frontend/assets/index-DIz4WrSB.js
HighChild Processdist/utils/github.js
HighShell
HighSame File Env Network Executiondist/utils/github.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighSpawned Bundled Service Listenerdist/cli.js
HighSemantic Analysis Limiteddist/frontend/assets/advancedFormat-tiBAHNGo.js#virtual:normalized:round1
HighSecret Patterndist/frontend/assets/index-DIz4WrSB.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to excalidrop@0.1.4.
See all versions of excalidrop for other recorded verdicts.
- Review the evidence and your use of excalidrop@0.1.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.