excalidrop@0.2.7
Remote GitHub-backed Excalidraw canvas + MCP server — no local server, one-command setup
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe relay supports the package’s remote canvas features, and its use is documented, but the MCP server also sends a GitHub credential to that relay by default for screenshot and viewport requests. That creates a meaningful credential exposure risk, so this warrants a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user requests an MCP screenshot or viewport operation while relay use is enabled by default.
Impact
The relay receives a credential for another service; this creates a risk of exposing or misusing access associated with that GitHub token.
Mechanism
The MCP server resolves a GitHub token and sends it in the Authorization Bearer header to excalidrop.wtf403.workers.dev.
AI rationale
The relay supports the package’s remote canvas features, and its use is documented, but the MCP server also sends a GitHub credential to that relay by default for screenshot and viewport requests. That creates a meaningful credential exposure risk, so this warrants a warning rather than a block.
Evidence
dist/mcp.jsREADME.md~/.config/excalidrop/gh_tokenos.tmpdir()/excalidrop-mcp.log
Network endpoints2
excalidrop.wtf403.workers.devgithub.com/login/device/code
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The MCP server reads GitHub credentials from GITHUB_TOKEN, gh auth, or its stored token file.
- Relay requests send the resolved GitHub token as a Bearer credential to the default Excalidrop relay host.
- The relay is used for user-triggered screenshot and viewport operations.
- The README identifies the shared relay, but does not explain that GitHub credentials are sent to it.
Evidence against
- The package is described as a remote GitHub-backed canvas, and relay operations serve that feature.
- GitHub login uses GitHub’s device flow, and the relay calls occur when screenshot or viewport operations are requested.
- The README discloses that screenshots and viewport features use the shared relay.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinified
Source & flagged code
9 flaggeddist/frontend/assets/index-DPE4WCka.jsView file
41patternName = google_api_key
severity = high
line = 41
High
High Secret
Package contains a high-severity secret pattern.
dist/frontend/assets/index-DPE4WCka.jsView on unpkg · L4141patternName = google_api_key
severity = high
line = 41
High
Secret Pattern
Google API key in dist/frontend/assets/index-DPE4WCka.js
dist/frontend/assets/index-DPE4WCka.jsView on unpkg · L41dist/mcp.jsView file
5process.env.NO_COLOR = '1';
L6: import { execSync } from 'node:child_process';
L7: import { deflateSync } from 'zlib';
High
Findings
2 Critical8 High4 Medium5 Low
CriticalCommand Output Exfiltrationskills/excalidraw-skill/scripts/gh-helper.cjs
CriticalPrevious Version Dangerous Deltadist/cli.js
HighHigh Secretdist/frontend/assets/index-DPE4WCka.js
HighChild Processdist/mcp.js
HighShell
HighEvaldist/frontend/assets/subset-shared.chunk.js
HighSame File Env Network Executiondist/mcp.js
HighRuntime Package Installdist/cli.js
HighSemantic Analysis Limiteddist/frontend/assets/advancedFormat-13WcrIKs.js#virtual:normalized:round1
HighSecret Patterndist/frontend/assets/index-DPE4WCka.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to excalidrop@0.2.7.
See all versions of excalidrop for other recorded verdicts.
- Review the evidence and your use of excalidrop@0.2.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.