registry / excalidrop / 0.2.15
excalidrop@0.2.15
Remote GitHub-backed Excalidraw canvas + MCP server — no local server, one-command setup
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe source uses GitHub credentials with GitHub's API and forwards them through the package's disclosed relay for canvas operations. The flagged lifecycle scripts build the package, and the command-execution findings are tied to explicit package operations.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Users run the MCP server or CLI and request canvas operations.
Impact
The reviewed flows match the package's GitHub-backed canvas purpose; no unrelated credential collection or command-output exfiltration was identified.
Mechanism
GitHub tokens are used for GitHub API calls. Relay RPC sends a token to excalidrop.wtf403.workers.dev, whose worker checks repository access through api.github.com.
AI rationale
The source uses GitHub credentials with GitHub's API and forwards them through the package's disclosed relay for canvas operations. The flagged lifecycle scripts build the package, and the command-execution findings are tied to explicit package operations.
Network endpoints4
api.github.comgithub.comexcalidrop.wtf403.workers.devjson.excalidraw.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The prepare and prepublishOnly scripts run the build; the manifest shows no install or postinstall hook.
- The MCP server reads GitHub credentials from GITHUB_TOKEN or gh auth token for its GitHub-backed canvas operations.
- The shared relay receives a Bearer token for RPC calls, and its worker uses that token to check access through the GitHub API.
- The README discloses that the relay forwards the GitHub token per request to GitHub's API.
- The skill helper uses the GitHub token for GitHub Contents API requests.
Evidence against
- The default relay is a third-party-hosted endpoint and receives the GitHub Bearer token for screenshot and viewport calls.
- The MCP server and CLI use child-process commands, including gh and npx, for GitHub operations and explicit setup.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Source & flagged code
9 flaggeddist/frontend/assets/index-BVWcEKOQ.jsView file
41patternName = google_api_key
severity = high
line = 41
High
High Secret
Package contains a high-severity secret pattern.
dist/frontend/assets/index-BVWcEKOQ.jsView on unpkg · L4141patternName = google_api_key
severity = high
line = 41
High
Secret Pattern
Google API key in dist/frontend/assets/index-BVWcEKOQ.js
dist/frontend/assets/index-BVWcEKOQ.jsView on unpkg · L41dist/mcp.jsView file
7process.env.NO_COLOR = '1';
L8: import { execSync } from 'node:child_process';
L9: import { deflateSync } from 'zlib';
High
Findings
2 Critical8 High4 Medium5 Low
CriticalCommand Output Exfiltrationskills/excalidraw-skill/scripts/gh-helper.cjs
CriticalPrevious Version Dangerous Deltadist/cli.js
HighHigh Secretdist/frontend/assets/index-BVWcEKOQ.js
HighChild Processdist/mcp.js
HighShell
HighEvaldist/frontend/assets/subset-shared.chunk.js
HighSame File Env Network Executiondist/mcp.js
HighRuntime Package Installdist/cli.js
HighSemantic Analysis Limiteddist/frontend/assets/advancedFormat-BI2QsyKs.js#virtual:normalized:round1
HighSecret Patterndist/frontend/assets/index-BVWcEKOQ.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to excalidrop@0.2.15.
See all versions of excalidrop for other recorded verdicts.
- Review the evidence and your use of excalidrop@0.2.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.