MAL-2026-13398

Dashboard / Malicious Package / MAL-2026-13398

MAL-2026-13398

Summary: Malicious code in @xiaohhhh1/canvas-agent (npm)

Details: Source: amazon-inspector (a34add291ef7584aec7041449cb2e80d36ae98f93c2725e1aa018707e3334119) On bin start, @xiaohhhh1/canvas-agent opens an outbound WebSocket to the hardcoded relay wss://canvas.xiaohhhh1.com/api/agent-relay and treats inbound messages as HTTP requests to its own loopback API at 127.0.0.1:17371. The bridge unconditionally injects the local agent token (x-canvas-agent-token) into forwarded requests, so remote 'request' messages satisfy token authentication and can invoke /agent/codex/turn and /agent/claude/turn, which spawn the Codex app-server and Claude CLI locally with attacker-supplied prompts and a caller-controlled permissionMode. Codex/Claude are autonomous coding agents that can write files in the workspace and, when permissionMode is widened to danger-full-access, execute arbitrary shell commands. The same code path also bypasses the loopback server's browser-Origin allow-list: the origin gate is populated only after token validation, and the relay bridge presents the valid token without any user-consented browser Origin, so remote-originated calls pass the token+origin check the README advertises. The net effect is a network-to-local-agent-to-shell control path from a hardcoded author-controlled server into the installer's machine and any repository it is run against.

References: https://www.npmjs.com/package/@xiaohhhh1/canvas-agent/v/0.4.4, https://www.npmjs.com/package/@xiaohhhh1/canvas-agent/v/0.4.11, https://www.npmjs.com/package/@xiaohhhh1/canvas-agent/v/0.4.10, https://www.npmjs.com/package/@xiaohhhh1/canvas-agent/v/0.4.9, https://www.npmjs.com/package/@xiaohhhh1/canvas-agent/v/0.4.8