excalidrop@0.2.13
Remote GitHub-backed Excalidraw canvas + MCP server — no local server, one-command setup
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe MCP server automatically discovers GitHub credentials and sends them to the package operator's shared relay for operations. This sends a credential for another service to an external host, so the package is malicious under the credential exfiltration rule.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
An MCP operation that uses the relay, such as an editing or viewport operation.
Impact
The relay operator receives GitHub credentials obtained from the user's environment or local configuration, outside GitHub's service.
Mechanism
The server resolves a GitHub token from the environment, GitHub CLI, or its token file and sends it as a bearer credential to the configured relay, which then uses it with GitHub's API.
Attack narrative
When a relay-backed MCP operation is called, the server obtains a GitHub token from the environment, GitHub CLI, or its local token file and sends it to the package's default shared relay. The relay uses that token to verify repository access and make GitHub API requests, exposing the credential to the relay operator in the process.
AI rationale
The MCP server automatically discovers GitHub credentials and sends them to the package operator's shared relay for operations. This sends a credential for another service to an external host, so the package is malicious under the credential exfiltration rule.
Evidence
dist/mcp.jsworker/src/relay.js
Network endpoints2
excalidrop.wtf403.workers.devapi.github.com
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- The MCP server resolves GitHub credentials from GITHUB_TOKEN, gh auth, or a local token file.
- The default relay is excalidrop.wtf403.workers.dev.
- MCP relay calls send the resolved GitHub token in the Authorization header.
- The package's relay worker accepts that bearer token and uses it in requests to api.github.com.
Evidence against
- The package is a remote GitHub-backed canvas MCP server, so GitHub access is part of its stated purpose.
- Relay requests occur when an MCP operation is called; the worker checks access to the selected repository before forwarding the operation.
- The CLI's project and MCP configuration writes occur in its setup flow.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
9 flaggeddist/frontend/assets/index-Dtc2YcdT.jsView file
41patternName = google_api_key
severity = high
line = 41
High
High Secret
Package contains a high-severity secret pattern.
dist/frontend/assets/index-Dtc2YcdT.jsView on unpkg · L4141patternName = google_api_key
severity = high
line = 41
High
Secret Pattern
Google API key in dist/frontend/assets/index-Dtc2YcdT.js
dist/frontend/assets/index-Dtc2YcdT.jsView on unpkg · L41dist/mcp.jsView file
7process.env.NO_COLOR = '1';
L8: import { execSync } from 'node:child_process';
L9: import { deflateSync } from 'zlib';
High
Findings
2 Critical8 High4 Medium5 Low
CriticalCommand Output Exfiltrationskills/excalidraw-skill/scripts/gh-helper.cjs
CriticalPrevious Version Dangerous Deltadist/cli.js
HighHigh Secretdist/frontend/assets/index-Dtc2YcdT.js
HighChild Processdist/mcp.js
HighShell
HighEvaldist/frontend/assets/subset-shared.chunk.js
HighSame File Env Network Executiondist/mcp.js
HighRuntime Package Installdist/cli.js
HighSemantic Analysis Limiteddist/frontend/assets/advancedFormat-D_hAUGHx.js#virtual:normalized:round1
HighSecret Patterndist/frontend/assets/index-Dtc2YcdT.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to excalidrop@0.2.13.
See all versions of excalidrop for other recorded verdicts.
- Avoid installing excalidrop@0.2.13. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.