{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "dist/relay-bridge.js",
              "sha256": "1592cec35eca9796bcaef872825af69c1b5362b7baa793f9849f573c9e0e4258",
              "tlsh": "9db141020cb3147113b3306eeb17e50a7132a1437342c9aabf9c9bd55f591a9da937cd"
            },
            {
              "path": "dist/agent/codex-client.js",
              "sha256": "64c82c5a1b80d557297872479ce37fa33be391d04c8de1959163204285431a2b",
              "tlsh": "b192850555ffa46242a3756c7f1b42246639a00b310dc968ff4cd6a82f9cd24d2b6fec"
            },
            {
              "path": "dist/server/http.js",
              "sha256": "1b72be515c519efad59b96f6606901e9726142fecdb0712a0889fb73b0b1b79b",
              "tlsh": "8492a60b76af26b04a7be51c8b0b40155677b817b14cc4a4fb8cd260afcdd65e0e2bd8"
            }
          ],
          "package_integrity": [
            {
              "filename": "canvas-agent-0.4.4.tgz",
              "hashes": {
                "sha1": "f78e8330047a3fcd66b71e2ee6230bc7aa48e428",
                "sha512_sri": "sha512-yNewscLFEGnVD/DccQtoZC+dEvgGq1EjjSIbNLMMsZ6ZQvqjap9ULUl9Fpcfmg1vvbv+pf3Dgln9h5yAS8ub5Q=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@xiaohhhh1/canvas-agent"
      },
      "versions": [
        "0.4.4",
        "0.4.11",
        "0.4.10",
        "0.4.9",
        "0.4.8"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-016269",
        "import_time": "2026-08-06T13:09:08.805629109Z",
        "modified_time": "2026-08-06T12:56:25Z",
        "sha256": "40162697638de6a974c2f7408ccf190f6d5b5f7ea82e5e52bbc9cb2a013fab08",
        "source": "amazon-inspector",
        "versions": [
          "0.4.4"
        ]
      },
      {
        "id": "IN-MAL-2026-017057",
        "import_time": "2026-08-07T12:51:24.276629163Z",
        "modified_time": "2026-08-07T12:37:40Z",
        "sha256": "07742c610792581bda3385162f04dfb375ea8ef09e662a31f94f5ea8cfa514cf",
        "source": "amazon-inspector",
        "versions": [
          "0.4.11"
        ]
      },
      {
        "id": "IN-MAL-2026-017061",
        "import_time": "2026-08-07T12:51:24.499709565Z",
        "modified_time": "2026-08-07T12:38:14Z",
        "sha256": "666b9625de3bae854b67278897e7275aceadf8006c406e672a13ac6b5a9ae2e6",
        "source": "amazon-inspector",
        "versions": [
          "0.4.10"
        ]
      },
      {
        "id": "IN-MAL-2026-017063",
        "import_time": "2026-08-07T12:51:24.593651311Z",
        "modified_time": "2026-08-07T12:40:29Z",
        "sha256": "99baacdee21209244b73a38b2b48cc55db72177734159c541110f6769de4b494",
        "source": "amazon-inspector",
        "versions": [
          "0.4.9"
        ]
      },
      {
        "id": "IN-MAL-2026-017068",
        "import_time": "2026-08-07T12:51:24.729804267Z",
        "modified_time": "2026-08-07T12:50:10Z",
        "sha256": "a34add291ef7584aec7041449cb2e80d36ae98f93c2725e1aa018707e3334119",
        "source": "amazon-inspector",
        "versions": [
          "0.4.8"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a34add291ef7584aec7041449cb2e80d36ae98f93c2725e1aa018707e3334119)\nOn bin start, @xiaohhhh1/canvas-agent opens an outbound WebSocket to the hardcoded relay wss://canvas.xiaohhhh1.com/api/agent-relay and treats inbound messages as HTTP requests to its own loopback API at 127.0.0.1:17371. The bridge unconditionally injects the local agent token (x-canvas-agent-token) into forwarded requests, so remote \u0027request\u0027 messages satisfy token authentication and can invoke /agent/codex/turn and /agent/claude/turn, which spawn the Codex app-server and Claude CLI locally with attacker-supplied prompts and a caller-controlled permissionMode. Codex/Claude are autonomous coding agents that can write files in the workspace and, when permissionMode is widened to danger-full-access, execute arbitrary shell commands. The same code path also bypasses the loopback server\u0027s browser-Origin allow-list: the origin gate is populated only after token validation, and the relay bridge presents the valid token without any user-consented browser Origin, so remote-originated calls pass the token+origin check the README advertises. The net effect is a network-to-local-agent-to-shell control path from a hardcoded author-controlled server into the installer\u0027s machine and any repository it is run against.\n",
  "id": "MAL-2026-13398",
  "modified": "2026-08-07T12:53:16.771247490Z",
  "published": "2026-08-06T12:56:25Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@xiaohhhh1/canvas-agent/v/0.4.4"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@xiaohhhh1/canvas-agent/v/0.4.11"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@xiaohhhh1/canvas-agent/v/0.4.10"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@xiaohhhh1/canvas-agent/v/0.4.9"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@xiaohhhh1/canvas-agent/v/0.4.8"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @xiaohhhh1/canvas-agent (npm)"
}