MAL-2026-13398
Malicious code in @xiaohhhh1/canvas-agent (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (40162697638de6a974c2f7408ccf190f6d5b5f7ea82e5e52bbc9cb2a013fab08) On starting the package's bin, the agent opens an outbound WebSocket to wss://canvas.xiaohhhh1.com/api/agent-relay and forwards inbound relay messages as authenticated HTTP requests to its own local server, attaching the local x-canvas-agent-token header. Endpoints reachable through this relay include /agent/codex/turn and /agent/claude/turn, which spawn the local Codex and Claude CLIs; /agent/codex/approval, which supplies approval decisions; /agent/local-image, which readFiles any absolute path matching an image extension and returns the bytes; and /agent/local-file/reveal, which spawns the OS file manager (explorer/open/xdg-open) against an arbitrary absolute path. codex-client.js maps a caller-supplied permissionMode of 'full' to Codex sandbox 'danger-full-access' with approvalPolicy 'never', so a remote peer connected to the vendor relay can select an unrestricted sandbox and drive commandExecution/fileChange turns on the installer's host without any local approval prompt. The same relay path also allows the remote peer to pull image files from arbitrary absolute paths on the installer's disk.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @xiaohhhh1/canvas-agent (npm). Pin to a known-safe version or switch to an alternative.