registry / excalidrop / 0.2.11
excalidrop@0.2.11
Remote GitHub-backed Excalidraw canvas + MCP server — no local server, one-command setup
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe flagged command helper uses GitHub credentials for GitHub API operations, and the MCP relay flow is part of the documented canvas functionality. The relay receives the token for requested relay operations and uses it to verify access to the selected repository; no unrelated exfiltration or concealed behavior was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Build scripts run during build or preparation; GitHub API and relay requests occur during setup or MCP operations, with relay RPC used for screenshot and viewport requests.
Impact
No malicious impact was identified. Relay requests expose the GitHub token to the package’s shared service for the documented operation.
Mechanism
The helper uses GitHub credentials for api.github.com. The MCP server sends the token to the documented shared relay for relay RPC, and the relay uses it to verify repository access.
AI rationale
The flagged command helper uses GitHub credentials for GitHub API operations, and the MCP relay flow is part of the documented canvas functionality. The relay receives the token for requested relay operations and uses it to verify access to the selected repository; no unrelated exfiltration or concealed behavior was found.
Evidence
~/.config/excalidrop/gh_token$TMPDIR/excalidrop-mcp.log
Network endpoints2
api.github.comexcalidrop.wtf403.workers.dev
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The prepare and prepublishOnly scripts run the package build.
- The skill helper resolves a GitHub token and uses it for GitHub API requests to api.github.com.
- The MCP server sends the token to the shared relay only for relay RPC calls such as requested screenshots; the README documents the relay and says it forwards the token to GitHub per request.
- The relay uses the token to verify access to the requested GitHub repository.
Evidence against
- The local MCP server forwards a resolved GitHub token to the default shared relay for screenshot and viewport requests, creating a trust boundary users should know about.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
9 flaggeddist/frontend/assets/index-BNbEa8iL.jsView file
41patternName = google_api_key
severity = high
line = 41
High
High Secret
Package contains a high-severity secret pattern.
dist/frontend/assets/index-BNbEa8iL.jsView on unpkg · L4141patternName = google_api_key
severity = high
line = 41
High
Secret Pattern
Google API key in dist/frontend/assets/index-BNbEa8iL.js
dist/frontend/assets/index-BNbEa8iL.jsView on unpkg · L41dist/mcp.jsView file
7process.env.NO_COLOR = '1';
L8: import { execSync } from 'node:child_process';
L9: import { deflateSync } from 'zlib';
High
Findings
2 Critical8 High4 Medium5 Low
CriticalCommand Output Exfiltrationskills/excalidraw-skill/scripts/gh-helper.cjs
CriticalPrevious Version Dangerous Deltadist/cli.js
HighHigh Secretdist/frontend/assets/index-BNbEa8iL.js
HighChild Processdist/mcp.js
HighShell
HighEvaldist/frontend/assets/subset-shared.chunk.js
HighSame File Env Network Executiondist/mcp.js
HighRuntime Package Installdist/cli.js
HighSemantic Analysis Limiteddist/frontend/assets/advancedFormat-DZ02N432.js#virtual:normalized:round1
HighSecret Patterndist/frontend/assets/index-BNbEa8iL.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to excalidrop@0.2.11.
See all versions of excalidrop for other recorded verdicts.
- Review the evidence and your use of excalidrop@0.2.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.