excalidrop@0.2.10
Remote GitHub-backed Excalidraw canvas + MCP server — no local server, one-command setup
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe MCP server forwards GitHub credentials obtained from the environment, GitHub CLI, or a saved file to the default shared Excalidrop relay when relay-backed operations run. This is credential disclosure to a third-party host without a separate consent step for those existing credentials.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
An MCP client invokes a relay-backed operation such as a screenshot request; relay use is on by default.
Impact
The relay operator receives a GitHub credential sourced from the user’s environment or CLI without a separate Excalidrop sign-in or consent step.
Mechanism
The server resolves a GitHub token from the environment, GitHub CLI, or saved token file and sends it in the Authorization bearer header to the relay endpoint.
Attack narrative
When a relay-backed MCP operation is requested, the server sends its resolved GitHub token to the shared Excalidrop Cloudflare relay. The token may come from GITHUB_TOKEN, gh auth token, or ~/.config/excalidrop/gh_token; relay forwarding is enabled by default. This exposes credentials obtained from existing local sources to a host other than GitHub.
AI rationale
The MCP server forwards GitHub credentials obtained from the environment, GitHub CLI, or a saved file to the default shared Excalidrop relay when relay-backed operations run. This is credential disclosure to a third-party host without a separate consent step for those existing credentials.
Evidence
dist/mcp.jsREADME.md~/.config/excalidrop/gh_token
Network endpoints1
excalidrop.wtf403.workers.dev
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package’s main entry is the MCP server, which implements a GitHub-backed Excalidraw canvas.
- The MCP server obtains credentials from GITHUB_TOKEN, gh auth token, or its saved token file.
- The default relay is excalidrop.wtf403.workers.dev, and relay requests send the resolved GitHub token as a bearer credential.
- Relay use is enabled by default and is used for screenshot requests; the README describes the shared relay as part of that feature.
Evidence against
- The relay supports the package’s screenshot and viewport features, and relay requests occur when those MCP operations are invoked.
- The relay can be disabled with --no-relay or EXCALIDROP_NO_RELAY=1.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
9 flaggeddist/frontend/assets/index-BQuFwudZ.jsView file
41patternName = google_api_key
severity = high
line = 41
High
High Secret
Package contains a high-severity secret pattern.
dist/frontend/assets/index-BQuFwudZ.jsView on unpkg · L4141patternName = google_api_key
severity = high
line = 41
High
Secret Pattern
Google API key in dist/frontend/assets/index-BQuFwudZ.js
dist/frontend/assets/index-BQuFwudZ.jsView on unpkg · L41dist/mcp.jsView file
5process.env.NO_COLOR = '1';
L6: import { execSync } from 'node:child_process';
L7: import { deflateSync } from 'zlib';
High
Findings
2 Critical8 High4 Medium5 Low
CriticalCommand Output Exfiltrationskills/excalidraw-skill/scripts/gh-helper.cjs
CriticalPrevious Version Dangerous Deltadist/cli.js
HighHigh Secretdist/frontend/assets/index-BQuFwudZ.js
HighChild Processdist/mcp.js
HighShell
HighEvaldist/frontend/assets/subset-shared.chunk.js
HighSame File Env Network Executiondist/mcp.js
HighRuntime Package Installdist/cli.js
HighSemantic Analysis Limiteddist/frontend/assets/advancedFormat-DE1yOycD.js#virtual:normalized:round1
HighSecret Patterndist/frontend/assets/index-BQuFwudZ.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to excalidrop@0.2.10.
See all versions of excalidrop for other recorded verdicts.
- Avoid installing excalidrop@0.2.10. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.