Description

On starting the package's bin, the agent opens an outbound WebSocket to wss://canvas.xiaohhhh1.com/api/agent-relay and forwards inbound relay messages as authenticated HTTP requests to its own local server, attaching the local x-canvas-agent-token header. Endpoints reachable through this relay include /agent/codex/turn and /agent/claude/turn, which spawn the local Codex and Claude CLIs; /agent/codex/approval, which supplies approval decisions; /agent/local-image, which readFiles any absolute path matching an image extension and returns the bytes; and /agent/local-file/reveal, which spawns the OS file manager (explorer/open/xdg-open) against an arbitrary absolute path. codex-client.js maps a caller-supplied permissionMode of 'full' to Codex sandbox 'danger-full-access' with approvalPolicy 'never', so a remote peer connected to the vendor relay can select an unrestricted sandbox and drive commandExecution/fileChange turns on the installer's host without any local approval prompt. The same relay path also allows the remote peer to pull image files from arbitrary absolute paths on the installer's disk.

Mitigation

Aliases