Malicious code in whiteboard-agent (npm)
The whiteboard-agent npm package contains malicious code in its postinstall script that silently exposes a local HTTP server to the public internet via Cloudflare tunnel in non-interactive environments (CI/CD, build agents), creates an unauthenticated admin account, and fetches an unsigned binary from a mutable release tag.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD environment installing whiteboard-agent npm package version 1.4.24 or later
- Ecosystems
- Attack vectors
- Affected entities
- whiteboard-agent · 1.4.24
The whiteboard-agent npm package (version 1.4.24) contains malicious behavior triggered during npm install. The postinstall script (scripts/postinstall.js) downloads a binary from a mutable nightly release tag on GitHub without SHA or signature verification, makes it executable, and in non-TTY environments (typical for CI/CD and build agents) spawns it detached.
In non-interactive installations, the package generates an admin account with a random 16-character hexadecimal password and starts a companion HTTP server on 127.0.0.1:3001 with COMPANION_LOCALHOST_BYPASS=1 enabled. It then spawns a Cloudflared tunnel that exposes this local server to a public *.trycloudflare.com URL without user knowledge or consent.
The attack surface is significant: anyone who discovers or guesses the tunnel URL can access the companion API without authentication beyond the randomly generated credential, which is stored locally without user notification. The package documentation describes interactive tunnel exposure via wendy start but does not warn that npm install itself performs this silently in non-interactive environments—the default scenario for CI/CD pipelines and containerized builds.
Additionally, the reliance on a mutable nightly release tag means every install, reinstall, or update fetches whatever binary is currently at that tag, creating a vector for future compromise if the release credentials are stolen or the repository is maliciously updated.
Indicators of compromise
- Packages
- whiteboard-agent@1.4.24
- Domains
- github.com/palmthree-studio/whiteboard-agent
- trycloudflare.com
Remediation
- Immediately uninstall whiteboard-agent from all environments
- Audit CI/CD logs and network traffic for unexpected Cloudflare tunnel URLs or outbound connections to *.trycloudflare.com during package installation
- Check for unauthorized admin accounts created on affected systems during the installation window
- Review and rotate any credentials or secrets that may have been exposed through the exposed HTTP server
- Do not reinstall whiteboard-agent until a patched version is released with signed binaries and explicit user consent for tunnel exposure
- Consider using npm audit to detect the package and block it via policy
Sources
- GitHub Advisory GHSA-w6cx-9c8h-cffm · GitHub Advisory Database
Cite this entry
"Malicious code in whiteboard-agent (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-whiteboard-agent-npm-6vc5uz
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in @antv/g-webgl-compute (npm)
The npm account `atool` was compromised and used to publish 631 malicious versions across 314 npm packages, including @antv/g-webgl-compute, as part of the "Mini Shai-Hulud" supply chain attack campaign. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.
npmOtherAccount takeoverCompromised packageMalicious commit - containedcritical
Malicious code in @antv/g2-ssr (npm)
The npm account `atool` was compromised and used to publish 631 malicious versions across 314 npm packages, including @antv/g2-ssr, in a 22-minute automated burst. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.
npmAccount takeoverCompromised packageMalicious commit - containedcritical
Malicious code in @antv/g6-extension-3d (npm)
A threat actor compromised the npm account `atool` and published 631 malicious versions across 314 npm packages, including @antv/g6-extension-3d, in a 22-minute automated burst. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.
npmOtherAccount takeoverCompromised packageMalicious commit - containedcritical
Malicious code in @antv/gi-assets-basic (npm)
A threat actor compromised the npm account 'atool' and published 631 malicious versions across 314 npm packages, including @antv/gi-assets-basic, in an automated 22-minute burst. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.
npmOtherAccount takeoverCompromised packageMalicious commit