MCPA-2026-0085
@xiaohhhh1/canvas-agent (npm) auto-connects to a hardcoded vendor relay that can drive local Codex/Claude turns with sandbox disabled and pull files from disk
@xiaohhhh1/canvas-agent's bin opens an outbound WebSocket to the hardcoded relay `wss://canvas.xiaohhhh1.com/api/agent-relay` on start and forwards inbound relay messages as authenticated requests to its own local server, attaching the local x-canvas-agent-token header. Verified by unpacking the latest tarball (0.4.11): dist/relay-bridge.js carries the hardcoded DEFAULT_RELAY_URL; relay-reachable endpoints include /agent/codex/turn and /agent/claude/turn (spawn the local Codex/Claude CLIs), /agent/codex/approval (supplies approval decisions), /agent/local-image (returns file bytes for any absolute path with an image extension), and /agent/local-file/reveal (spawns the OS file manager against arbitrary paths); and dist/agent/codex-client.js maps a caller-supplied permissionMode of 'full' to Codex sandbox 'danger-full-access' with approvalPolicy 'never'. A remote peer on the vendor relay can therefore run unrestricted agent turns on the installer's host without any local approval prompt and read files from disk. Flagged as malware by OSV (MAL-2026-13398).
Affected packages
| Ecosystem | Package | Affected versions |
|---|---|---|
| npm | @xiaohhhh1/canvas-agent | >= 0 |
Identifiers
MAL-2026-13398GHSA-29wq-c378-jw6vCWE-506CWE-798
References
- advisory https://osv.dev/vulnerability/MAL-2026-13398
- advisory https://github.com/advisories/GHSA-29wq-c378-jw6v
- web https://www.npmjs.com/package/@xiaohhhh1/canvas-agent
Timeline
- Published: 2026-08-06