excalidrop@0.2.5
Remote GitHub-backed Excalidraw canvas + MCP server — no local server, one-command setup
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe default-on screenshot relay transmits a discovered GitHub token to a non-GitHub host without an explicit consent step. The credential source, relay destination, and screenshot-tool trigger are visible in the MCP server source.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A client invokes get_canvas_screenshot or export_to_image while the relay is enabled, which is the default.
Impact
The relay operator receives a GitHub credential that can authorize access to the user's repositories.
Mechanism
The server resolves a token from the environment, GitHub CLI, or stored token file, then includes it as a Bearer credential in a POST to the relay.
Attack narrative
When screenshot or image-export tools are called, the MCP server sends a token resolved from GITHUB_TOKEN, gh auth, or its stored token file to excalidrop.wtf403.workers.dev as a Bearer credential. Relay use is enabled by default. This gives the package operator a user's GitHub credential outside GitHub; the documented relay feature does not establish user consent to disclose that credential.
AI rationale
The default-on screenshot relay transmits a discovered GitHub token to a non-GitHub host without an explicit consent step. The credential source, relay destination, and screenshot-tool trigger are visible in the MCP server source.
Evidence
dist/mcp.js~/.config/excalidrop/gh_token
Network endpoints2
excalidrop.wtf403.workers.devapi.github.com
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The MCP server obtains a GitHub token from GITHUB_TOKEN, gh auth, or its stored token file.
- By default, the relay URL is excalidrop.wtf403.workers.dev, and relay requests send the GitHub token as a Bearer credential.
- Relay use is enabled by default; screenshot requests call the relay unless the user sets an opt-out.
- The get_canvas_screenshot and export_to_image MCP tools trigger that screenshot path.
Evidence against
- The package describes itself as a remote GitHub-backed canvas and documents the relay as supporting screenshots and viewport operations.
- The flagged gh-helper sends its GitHub token to api.github.com, the credential’s own service.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
9 flaggeddist/frontend/assets/index-BhUVktMi.jsView file
41patternName = google_api_key
severity = high
line = 41
High
High Secret
Package contains a high-severity secret pattern.
dist/frontend/assets/index-BhUVktMi.jsView on unpkg · L4141patternName = google_api_key
severity = high
line = 41
High
Secret Pattern
Google API key in dist/frontend/assets/index-BhUVktMi.js
dist/frontend/assets/index-BhUVktMi.jsView on unpkg · L41dist/mcp.jsView file
5process.env.NO_COLOR = '1';
L6: import { execSync } from 'node:child_process';
L7: import { deflateSync } from 'zlib';
High
Findings
2 Critical8 High4 Medium5 Low
CriticalCommand Output Exfiltrationskills/excalidraw-skill/scripts/gh-helper.cjs
CriticalPrevious Version Dangerous Deltadist/cli.js
HighHigh Secretdist/frontend/assets/index-BhUVktMi.js
HighChild Processdist/mcp.js
HighShell
HighEvaldist/frontend/assets/subset-shared.chunk.js
HighSame File Env Network Executiondist/mcp.js
HighRuntime Package Installdist/cli.js
HighSemantic Analysis Limiteddist/frontend/assets/advancedFormat-Dp_c57XA.js#virtual:normalized:round1
HighSecret Patterndist/frontend/assets/index-BhUVktMi.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to excalidrop@0.2.5.
See all versions of excalidrop for other recorded verdicts.
- Avoid installing excalidrop@0.2.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.