excalidrop@0.2.1
Remote GitHub-backed Excalidraw canvas + MCP server — no local server, one-command setup
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package’s documented relay feature sends a GitHub token to the vendor’s default relay during requested screenshot or viewport operations. Because the relay is disclosed and the transfer is tied to those operations, this is a warning-level credential exposure risk rather than clear evidence of malicious collection.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
An MCP client requests a screenshot or viewport operation while relay use is enabled by default.
Impact
The relay receives a GitHub credential that may carry broader account or repository access than the requested canvas operation requires.
Mechanism
The server obtains a GitHub token from the environment, GitHub CLI, or its saved token file and includes it as a Bearer token in a POST to the relay.
AI rationale
The package’s documented relay feature sends a GitHub token to the vendor’s default relay during requested screenshot or viewport operations. Because the relay is disclosed and the transfer is tied to those operations, this is a warning-level credential exposure risk rather than clear evidence of malicious collection.
Evidence
dist/mcp.jsREADME.md~/.config/excalidrop/gh_token
Network endpoints2
excalidrop.wtf403.workers.devapi.github.com
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The MCP server resolves a GitHub token from GITHUB_TOKEN, `gh auth token`, or `~/.config/excalidrop/gh_token`.
- Relay requests send that token as a Bearer authorization header to the configured relay, which defaults to `excalidrop.wtf403.workers.dev`; relay use is enabled by default.
- The relay path is used for screenshot requests, and the README identifies screenshots and viewport control as shared-relay features.
- The token is sent during a requested relay operation, rather than automatically during package installation or server startup.
Evidence against
- The package’s stated purpose is a remote GitHub-backed canvas, and its normal drawing and storage operations use GitHub’s API.
- The README discloses the shared relay and documents `EXCALIDROP_NO_RELAY` as a way to use a GitHub command-queue fallback.
- The manifest’s `prepare` and `prepublishOnly` scripts build the package; no install-time data collection was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
9 flaggeddist/frontend/assets/index-GTq6y6g6.jsView file
41patternName = google_api_key
severity = high
line = 41
High
High Secret
Package contains a high-severity secret pattern.
dist/frontend/assets/index-GTq6y6g6.jsView on unpkg · L4141patternName = google_api_key
severity = high
line = 41
High
Secret Pattern
Google API key in dist/frontend/assets/index-GTq6y6g6.js
dist/frontend/assets/index-GTq6y6g6.jsView on unpkg · L41dist/mcp.jsView file
5process.env.NO_COLOR = '1';
L6: import { execSync } from 'node:child_process';
L7: import { deflateSync } from 'zlib';
High
Findings
2 Critical8 High4 Medium5 Low
CriticalCommand Output Exfiltrationskills/excalidraw-skill/scripts/gh-helper.cjs
CriticalPrevious Version Dangerous Deltadist/cli.js
HighHigh Secretdist/frontend/assets/index-GTq6y6g6.js
HighChild Processdist/mcp.js
HighShell
HighEvaldist/frontend/assets/subset-shared.chunk.js
HighSame File Env Network Executiondist/mcp.js
HighRuntime Package Installdist/cli.js
HighSemantic Analysis Limiteddist/frontend/assets/advancedFormat-CsxROTkH.js#virtual:normalized:round1
HighSecret Patterndist/frontend/assets/index-GTq6y6g6.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to excalidrop@0.2.1.
See all versions of excalidrop for other recorded verdicts.
- Review the evidence and your use of excalidrop@0.2.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.