excalidrop@0.2.2
Remote GitHub-backed Excalidraw canvas + MCP server — no local server, one-command setup
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe MCP relay forwards credentials sourced from the user's GitHub environment, CLI, or stored token file to a separate default host when screenshot functionality is invoked. Because the token is sent to a host other than GitHub without explicit consent to that forwarding, this is credential exfiltration.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
An MCP client invokes the screenshot feature while relay use is enabled, which is the default.
Impact
The relay operator receives a GitHub credential that belongs to GitHub, exposing the user's account or repository access beyond the service that issued the token.
Mechanism
The MCP server obtains a token from GITHUB_TOKEN, the GitHub CLI, or its stored token file, then sends it in a Bearer header to EXCALIDROP_RELAY_URL or excalidrop.wtf403.workers.dev.
Attack narrative
When the MCP screenshot feature is used, the server obtains the user's GitHub token and posts it as a Bearer credential to the Excalidrop relay, enabled by default. This sends a GitHub credential to a separate vendor-controlled host without an explicit consent step for that forwarding.
AI rationale
The MCP relay forwards credentials sourced from the user's GitHub environment, CLI, or stored token file to a separate default host when screenshot functionality is invoked. Because the token is sent to a host other than GitHub without explicit consent to that forwarding, this is credential exfiltration.
Evidence
dist/mcp.js
Network endpoints2
excalidrop.wtf403.workers.devapi.github.com
Decision evidence
public snapshotAI called this Malicious at 92.0% confidence as Malware with low false-positive risk.
Evidence for block
- The MCP server resolves a GitHub token from GITHUB_TOKEN, `gh auth token`, or its stored token file.
- By default, relayRpc sends that token as a Bearer authorization header to the configured relay, whose default host is excalidrop.wtf403.workers.dev.
- The screenshot tool calls relayRpc by default, so invoking that feature forwards the GitHub credential to the relay.
Evidence against
- The package is presented as a remote GitHub-backed Excalidraw canvas and uses GitHub APIs for scene access and updates.
- The skill helper sends its GitHub token to api.github.com for repository content operations, consistent with its purpose.
- The MCP server starts only when invoked as the entry script; setup and agent configuration changes are CLI commands.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
9 flaggeddist/frontend/assets/index-Bd-8869C.jsView file
41patternName = google_api_key
severity = high
line = 41
High
High Secret
Package contains a high-severity secret pattern.
dist/frontend/assets/index-Bd-8869C.jsView on unpkg · L4141patternName = google_api_key
severity = high
line = 41
High
Secret Pattern
Google API key in dist/frontend/assets/index-Bd-8869C.js
dist/frontend/assets/index-Bd-8869C.jsView on unpkg · L41dist/mcp.jsView file
5process.env.NO_COLOR = '1';
L6: import { execSync } from 'node:child_process';
L7: import { deflateSync } from 'zlib';
High
Findings
2 Critical8 High4 Medium5 Low
CriticalCommand Output Exfiltrationskills/excalidraw-skill/scripts/gh-helper.cjs
CriticalPrevious Version Dangerous Deltadist/cli.js
HighHigh Secretdist/frontend/assets/index-Bd-8869C.js
HighChild Processdist/mcp.js
HighShell
HighEvaldist/frontend/assets/subset-shared.chunk.js
HighSame File Env Network Executiondist/mcp.js
HighRuntime Package Installdist/cli.js
HighSemantic Analysis Limiteddist/frontend/assets/advancedFormat-Be4KR5mp.js#virtual:normalized:round1
HighSecret Patterndist/frontend/assets/index-Bd-8869C.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to excalidrop@0.2.2.
See all versions of excalidrop for other recorded verdicts.
- Avoid installing excalidrop@0.2.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.